summaryrefslogtreecommitdiff
path: root/src/security
AgeCommit message (Collapse)Author
2022-10-06security/memory/memory.h: Add <stdbool.h>Elyes Haouas
Signed-off-by: Elyes Haouas <ehaouas@noos.fr> Change-Id: I908445b9f87b3db90527955116db22bbee674e1f Reviewed-on: https://review.coreboot.org/c/coreboot/+/68046 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Martin Roth <martin.roth@amd.corp-partner.google.com>
2022-09-30drivers/crb: Add SMBIOS hook to generate type 43 TPM DeviceMichał Żygowski
Example for Alder Lake PTT: Handle 0x004C, DMI type 43, 31 bytes TPM Device Vendor ID: INTC Specification Version: 2.0 Firmware Revision: 600.18 Description: Intel iTPM Characteristics: TPM Device characteristics not supported OEM-specific Information: 0x00000000 TEST=Execute dmidecode and see the type 43 is populated with PTT on MSI PRO Z690-A WIFI DDR4 Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com> Change-Id: I05289f98969bd431017aff1aa77be5806d6f1838 Reviewed-on: https://review.coreboot.org/c/coreboot/+/64049 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Christian Walter <christian.walter@9elements.com>
2022-09-17security/vboot: Add rollback NVRAM space for TPM 2Miriam Polzer
Create an NVRAM space in TPM 2.0 that survives owner clear and can be read and written without authorization. This space allows to seal data with the TPM that can only be unsealed before the space was cleared. It will be used during ChromeOS enterprise rollback to securely carry data across a TPM clear. Public documentation on the rollback feature: https://source.chromium.org/chromium/chromiumos/platform2/+/main:oobe_config/README.md BUG=b/233746744 Signed-off-by: Miriam Polzer <mpolzer@google.com> Change-Id: I59ca0783b41a6f9ecd5b72f07de6fb403baf2820 Reviewed-on: https://review.coreboot.org/c/coreboot/+/66623 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
2022-09-15src/security: Use "if (!ptr)" in preference to "if (ptr == NULL)"Elyes Haouas
Signed-off-by: Elyes Haouas <ehaouas@noos.fr> Change-Id: I3def65c016015d8213824e6b8561d8a67b6d5cf0 Reviewed-on: https://review.coreboot.org/c/coreboot/+/67579 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Yu-Ping Wu <yupingso@google.com>
2022-09-14timer: Change timer util functions to 64-bitRob Barnes
Since mono_time is now 64-bit, the utility functions interfacing with mono_time should also be 64-bit so precision isn't lost. Fixed build errors related to printing the now int64_t result of stopwatch_duration_[m|u]secs in various places. BUG=b:237082996 BRANCH=All TEST=Boot dewatt Change-Id: I169588f5e14285557f2d03270f58f4c07c0154d5 Signed-off-by: Rob Barnes <robbarnes@google.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/66170 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Werner Zeh <werner.zeh@siemens.com> Reviewed-by: Raul Rangel <rrangel@chromium.org> Reviewed-by: Yu-Ping Wu <yupingso@google.com>
2022-09-12drivers/intel/ptt: Use the correct detection methodMichał Żygowski
On some platforms the HFSTS4 bit 19 does not indicate active PTT. Instead of ME HFSTS4, use TXT FTIF register to check active TPM for the current boot. Discrete TPM shall be deactivated when PTT is enabled so this always should return true value of PTT state. Leave the old method for backwards compatibility if TXT FTIF would not be applicable for older microarchitectures. Based on DOC #560297. TEST=Check if PTT is detected as active on MSI PRO Z690-A DDR4 WIFI Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com> Change-Id: I3a55c9f38f5bb94fb1186592446a28e675c1207c Reviewed-on: https://review.coreboot.org/c/coreboot/+/63956 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Krystian Hebel <krystian.hebel@3mdeb.com>
2022-09-04security/vboot/tpm: Avoid duplicate vb2api_secdata_firmware_create callsYu-Ping Wu
For TPM2, vb2api_secdata_firmware_create() is already called from setup_firmware_space() from _factory_initialize_tpm(). Therefore move the duplicate call from factory_initialize_tpm() to TPM1's _factory_initialize_tpm(). Change-Id: I892df65c847e1aeeabef8a7578bec743b639a127 Signed-off-by: Yu-Ping Wu <yupingso@chromium.org> Reviewed-on: https://review.coreboot.org/c/coreboot/+/67219 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Aseda Aboagye <aaboagye@google.com> Reviewed-by: Julius Werner <jwerner@chromium.org>
2022-09-03soc/intel: Add SI_DESC region to GSCVD rangesJulius Werner
Intel platforms have soft straps stored in the SI_DESC FMAP section which can alter boot behavior and may open up a security risk if they can be modified by an attacker. This patch adds the SI_DESC region to the list of ranges covered by GSC verification (CONFIG_VBOOT_GSCVD). Signed-off-by: Julius Werner <jwerner@chromium.org> Change-Id: I0f1b297e207d3c6152bf99ec5a5b0983f01b2d0b Reviewed-on: https://review.coreboot.org/c/coreboot/+/66346 Reviewed-by: Yu-Ping Wu <yupingso@google.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2022-09-02cbfs/vboot: Adapt to new vb2_digest APIJulius Werner
CL:3825558 changes all vb2_digest and vb2_hash functions to take a new hwcrypto_allowed argument, to potentially let them try to call the vb2ex_hwcrypto API for hash calculation. This change will open hardware crypto acceleration up to all hash calculations in coreboot (most notably CBFS verification). As part of this change, the vb2_digest_buffer() function has been removed, so replace existing instances in coreboot with the newer vb2_hash_calculate() API. Due to the circular dependency of these changes with vboot, this patch also needs to update the vboot submodule: Updating from commit id 18cb85b5: 2load_kernel.c: Expose load kernel as vb2_api to commit id b827ddb9: tests: Ensure auxfw sync runs after EC sync This brings in 15 new commits. Signed-off-by: Julius Werner <jwerner@chromium.org> Change-Id: I287d8dac3c49ad7ea3e18a015874ce8d610ec67e Reviewed-on: https://review.coreboot.org/c/coreboot/+/66561 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Jakub Czapiga <jacz@semihalf.com>
2022-08-29drivers/i2c/tpm: Remove TI50_FIRMWARE_VERSION_NOT_SUPPORTEDReka Norman
This workaround was added since reading the firmware version on Ti50 versions < 0.0.15 will cause the Ti50 to become unresponsive. No one is using Ti50 this old anymore, so remove the workaround. BUG=b:224650720,b:236911319 TEST=Boot to OS on nivviks with Ti50 0.22.4. Check the log contains the firmware version: [INFO ] Firmware version: Ti50/D3C1 RO_B:0.0.26/- RW_B:0.22.4/ti50_common:v095c Change-Id: I3628b799e436a80d0512dabd356c4b2566ed600a Signed-off-by: Reka Norman <rekanorman@chromium.org> Reviewed-on: https://review.coreboot.org/c/coreboot/+/67138 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Kangheui Won <khwon@chromium.org> Reviewed-by: Subrata Banik <subratabanik@google.com> Reviewed-by: Kapil Porwal <kapilporwal@google.com>
2022-08-22Add SBOM (Software Bill of Materials) GenerationMaximilian Brune
Firmware is typically delivered as one large binary image that gets flashed. Since this final image consists of binaries and data from a vast number of different people and companies, it's hard to determine what all the small parts included in it are. The goal of the software bill of materials (SBOM) is to take a firmware image and make it easy to find out what it consists of and where those pieces came from. Basically, this answers the question, who supplied the code that's running on my system right now? For example, buyers of a system can use an SBOM to perform an automated vulnerability check or license analysis, both of which can be used to evaluate risk in a product. Furthermore, one can quickly check to see if the firmware is subject to a new vulnerability included in one of the software parts (with the specified version) of the firmware. Further reference: https://web.archive.org/web/20220310104905/https://blogs.gnome.org/hughsie/2022/03/10/firmware-software-bill-of-materials/ - Add Makefile.inc to generate and build coswid tags - Add templates for most payloads, coreboot, intel-microcode, amd-microcode. intel FSP-S/M/T, EC, BIOS_ACM, SINIT_ACM, intel ME and compiler (gcc,clang,other) - Add Kconfig entries to optionally supply a path to CoSWID tags instead of using the default CoSWID tags - Add CBFS entry called SBOM to each build via Makefile.inc - Add goswid utility tool to generate SBOM data Signed-off-by: Maximilian Brune <maximilian.brune@9elements.com> Change-Id: Icb7481d4903f95d200eddbfed7728fbec51819d0 Reviewed-on: https://review.coreboot.org/c/coreboot/+/63639 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Martin Roth <martin.roth@amd.corp-partner.google.com>
2022-08-21tpm: Correct TI50_FIRMWARE_VERSION_NOT_SUPPORTED help textYu-Ping Wu
Reading firmware_version register is supported on Ti50 version 0.22.4. Therefore correct the help text of the Kconfig option TI50_FIRMWARE_VERSION_NOT_SUPPORTED. Also change the message level to BIOS_WARNING. BUG=b:234533588 TEST=emerge-corsola coreboot BRANCH=none Change-Id: I66a0ef896c9dc4cd0f586555a55dbcd1cfd863f9 Signed-off-by: Yu-Ping Wu <yupingso@chromium.org> Reviewed-on: https://review.coreboot.org/c/coreboot/+/66906 Reviewed-by: Yidi Lin <yidilin@chromium.org> Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Andrey Pronin <apronin@google.com> Reviewed-by: Hung-Te Lin <hungte@chromium.org>
2022-07-30security/vboot: Simplify image signingJakub Czapiga
futility now supports image truncation and signing of whole images with a single command invocation. Use it for vboot-enabled coreboot images. TEST=Build and run coreboot on google/volteer Signed-off-by: Jakub Czapiga <jacz@semihalf.com> Change-Id: I49eb7e977b635ccb9f6c1b76e53c36e82be1d795 Reviewed-on: https://review.coreboot.org/c/coreboot/+/66127 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Julius Werner <jwerner@chromium.org> Reviewed-by: Yu-Ping Wu <yupingso@google.com>
2022-07-20treewide: Remove unused <cpu/x86/msr.h>Elyes Haouas
Change-Id: I187c2482dd82c6c6d1fe1cbda71710ae1a2f54ad Signed-off-by: Elyes Haouas <ehaouas@noos.fr> Reviewed-on: https://review.coreboot.org/c/coreboot/+/64890 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Felix Held <felix-coreboot@felixheld.de>
2022-07-17security/intel/txt/common.c: Remove unuseful "else" after "return"Elyes HAOUAS
"else" is unuseful after a "break" or "return". Change-Id: I7273b9af46a2310c9981ffd20afe2c8c7e061479 Signed-off-by: Elyes Haouas <ehaouas@noos.fr> Reviewed-on: https://review.coreboot.org/c/coreboot/+/60910 Reviewed-by: Paul Menzel <paulepanter@mailbox.org> Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Felix Singer <felixsinger@posteo.net>
2022-07-13cpu/x86/mp_init: retype do_smm element in mp_state struct to boolFelix Held
The do_smm struct element in the mp_state struct was an int even though it only had two possible states, so change it to bool to make this more obvious. Also change the return type of is_smm_enabled from int to bool. Signed-off-by: Felix Held <felix-coreboot@felixheld.de> Change-Id: I8d2d95f0497649d67565243d14a5ab9c9cdda412 Reviewed-on: https://review.coreboot.org/c/coreboot/+/65776 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Arthur Heymans <arthur@aheymans.xyz>
2022-07-04treewide: Unify Google brandingJon Murphy
Branding changes to unify and update Chrome OS to ChromeOS (removing the space). This CL also includes changing Chromium OS to ChromiumOS as well. BUG=None TEST=N/A Change-Id: I39af9f1069b62747dbfeebdd62d85fabfa655dcd Signed-off-by: Jon Murphy <jpmurphy@google.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/65479 Reviewed-by: Jack Rosenthal <jrosenth@chromium.org> Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Felix Singer <felixsinger@posteo.net>
2022-06-22security/vboot: Deprecate VBOOT_VBNV_ECYu-Ping Wu
Boards using VBOOT_VBNV_EC (nyan, daisy, veyron, peach_pit) are all ChromeOS devices and they've reached the end of life since Feb 2022. Therefore, remove VBOOT_VBNV_EC for them, each with different replacement. - nyan (nyan, nyan_big, nyan_blaze): Add RW_NVRAM to their FMAP (by reducing the size of RW_VPD), and replace VBOOT_VBNV_EC with VBOOT_VBNV_FLASH. - veyron: Add RW_NVRAM to their FMAP (by reducing the size of SHARED_DATA), and replace VBOOT_VBNV_EC with VBOOT_VBNV_FLASH. Also enlarge the OVERLAP_VERSTAGE_ROMSTAGE section for rk3288 (by reducing the size of PRERAM_CBMEM_CONSOLE), so that verstage won't exceed its allotted size. - daisy: Because BOOT_DEVICE_SPI_FLASH is not set, which is required for VBOOT_VBNV_FLASH, disable MAINBOARD_HAS_CHROMEOS and VBOOT configs. - peach_pit: As VBOOT is not set, simply remove the unused VBOOT_VBNV_EC option. Remove the VBOOT_VBNV_EC Kconfig option as well as related code, leaving VBOOT_VBNV_FLASH and VBOOT_VBNV_CMOS as the only two backend options for vboot nvdata (VBNV). Also add a check in read_vbnv() and save_vbnv() for VBNV options. BUG=b:178689388 TEST=util/abuild/abuild -t GOOGLE_NYAN -x -a TEST=util/abuild/abuild -t GOOGLE_VEYRON_JAQ -x -a TEST=util/abuild/abuild -t GOOGLE_DAISY -a TEST=util/abuild/abuild -t GOOGLE_PEACH_PIT -a BRANCH=none Change-Id: Ic67d69e694cff3176dbee12d4c6311bc85295863 Signed-off-by: Yu-Ping Wu <yupingso@chromium.org> Reviewed-on: https://review.coreboot.org/c/coreboot/+/65012 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
2022-06-21security/vboot: Add support for GSCVD (Google "RO verification")Julius Werner
This patch adds a new CONFIG_VBOOT_GSCVD option that will be enabled by default for TPM_GOOGLE_TI50 devices. It makes the build system run the `futility gscvd` command to create a GSCVD (GSC verification data) which signs the CBFS trust anchor (bootblock and GBB). In order for this to work, boards will need to have an RO_GSCVD section in their FMAP, and production boards should override the CONFIG_VBOOT_GSC_BOARD_ID option with the correct ID for each variant. BUG=b:229015103 Signed-off-by: Julius Werner <jwerner@chromium.org> Change-Id: I1cf86e90b2687e81edadcefa5a8826b02fbc8b24 Reviewed-on: https://review.coreboot.org/c/coreboot/+/64707 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Yu-Ping Wu <yupingso@google.com>
2022-06-08drivers/tpm/cr50: Add TPM IRQ timeout Kconfig optionYu-Ping Wu
The current 10ms timeout for SPI TPM IRQ is not enough for platforms using ti50 (such as corsola). Therefore, introduce a new Kconfig option 'GOOGLE_TPM_IRQ_TIMEOUT_MS'. For platforms using cr50, we need to support legacy pre-ready-IRQ cr50 factory images during the initial boot, so the timeout remains 100ms for I2C TPM and 10ms for SPI TPM. For all the other platforms using ti50, the default timeout is increased to 750ms, as suggested by the ti50 team (apronin@google.com). BUG=b:232327704 TEST=emerge-corsola coreboot BRANCH=none Change-Id: I8dbb919e4a421a99a994913613a33738a49f5956 Signed-off-by: Yu-Ping Wu <yupingso@chromium.org> Reviewed-on: https://review.coreboot.org/c/coreboot/+/64412 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Hung-Te Lin <hungte@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
2022-06-01cbfs: Rename TYPE_FIT to TYPE_FIT_PAYLOADJulius Werner
There are too many "FIT" in firmware land. In order to reduce possible confusion of CBFS_TYPE_FIT with the Intel Firmware Interface Table, this patch renames it to CBFS_TYPE_FIT_PAYLOAD (including the cbfstool argument, so calling scripts will now need to replace `-t fit` with `-t fit_payload`). Signed-off-by: Julius Werner <jwerner@chromium.org> Change-Id: I826cefce54ade06c6612c8a7bb53e02092e7b11a Reviewed-on: https://review.coreboot.org/c/coreboot/+/64735 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Yu-Ping Wu <yupingso@google.com>
2022-05-24security/tpm/crtm: Add a function to measure the bootblock on SoC levelWerner Zeh
On platforms where the bootblock is not included in CBFS anymore (because it is part of another firmware section (IFWI or a different CBFS), the CRTM measurement fails. This patch adds a new function to provide a way at SoC level to measure the bootblock. Following patches will add functionality to retrieve the bootblock from the SoC related location and measure it from there. In this way the really executed code will be measured. Change-Id: I6d0da1e95a9588eb5228f63151bb04bfccfcf04b Signed-off-by: Werner Zeh <werner.zeh@siemens.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/64492 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Arthur Heymans <arthur@aheymans.xyz>
2022-05-24security/tpm/crtm: Use bootblock from FMAP on non x86 platformsWerner Zeh
All non x86 platforms use bootblock in FMAP (see Makefile.inc). Add a build time check for that so that all the other possibilities (CBFS or other places for the bootblock) are dropped at build time. Change-Id: Ic18336a0b79b5d319c2cdfecb7e1eeb89d241206 Signed-off-by: Werner Zeh <werner.zeh@siemens.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/64520 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Arthur Heymans <arthur@aheymans.xyz>
2022-05-24security/tpm/crtm.c: Fix !CONFIG_BOOTBLOCK_IN_CBFS measuringArthur Heymans
On some platforms the bootblock is not placed in cbfs, but embedded inside another binary that loads in into DRAM/SRAM. e8217b11f1 (Kconfig: Add an option to skip adding a cbfs bootblock on x86) removed adding a cbfs file containing the bootblock in that case. Change-Id: Id47ecedbc8713ebd5d9814f1c4faf43c52780447 Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Signed-off-by: Werner Zeh <werner.zeh@siemens.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/64418 Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2022-05-20CBMEM: Change declarations for initialization hooksKyösti Mälkki
There are efforts to have bootflows that do not follow a traditional bootblock-romstage-postcar-ramstage model. As part of that CBMEM initialisation hooks will need to move from romstage to bootblock. The interface towards platforms and drivers will change to use one of CBMEM_CREATION_HOOK() or CBMEM_READY_HOOK(). Former will only be called in the first stage with CBMEM available. Change-Id: Ie24bf4e818ca69f539196c3a814f3c52d4103d7e Signed-off-by: Kyösti Mälkki <kyosti.malkki@gmail.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/63375 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-by: Julius Werner <jwerner@chromium.org> Reviewed-by: Raul Rangel <rrangel@chromium.org>
2022-05-16drivers/i2c/tpm: Work around missing firmware_version in Ti50 < 0.0.15Reka Norman
Ti50 firmware versions below 0.0.15 don't support the firmware_version register and trying to access it causes I2C errors. Some nissa boards are still using Ti50 0.0.12, so add a workaround Kconfig to skip reading the firmware version and select it for nissa. The firmware version is only read to print it to the console, so it's fine to skip this. This workaround will be removed once all ODM stocks are updated to 0.0.15 or higher. A similar workaround Kconfig was added in CB:63011 then removed in CB:63158 which added support for separate handling of Cr50 and Ti50. But we actually still need this workaround until all Ti50 stocks are upgraded to 0.0.15 or higher. BUG=b:224650720 TEST=Boot to OS on nereid with Ti50 0.0.14 Change-Id: Ia30d44ac231c42eba3ffb1cb1e6d83bb6593f926 Signed-off-by: Reka Norman <rekanorman@chromium.org> Reviewed-on: https://review.coreboot.org/c/coreboot/+/64202 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
2022-05-16src: Remove unused <cf9_reset.h>Elyes Haouas
Found using: diff <(git grep -l '#include <cf9_reset.h>' -- src/) <(git grep -l 'RST_CNT\|FULL_RST\|RST_CPU\|SYS_RST\|do_system_reset\|do_full_reset\|cf9_reset_prepare\|system_reset\|full_reset' -- src/) |grep "<" Change-Id: I093d8412e14ce81b462fb9a7ccb3a2a93ae760a6 Signed-off-by: Elyes Haouas <ehaouas@noos.fr> Reviewed-on: https://review.coreboot.org/c/coreboot/+/60803 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Martin L Roth <gaumless@tutanota.com>
2022-05-12security/intel/cbnt/Makefile.inc: Improve build flowArthur Heymans
Using 'files_added::' is no longer needed as all files have already been added to the build. This has the advantage of showing all final entries in the FIT table and CBFS during the build process as adding the bpm to cbfs and fit is moved earlier. Change-Id: I22aa140202f0665b7095a01cb138af4986aa9ac3 Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/56119 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2022-05-12Makefile.inc: Generate master header and pointer as C structsArthur Heymans
The makefiles don't like cbfs file names with spaces in them so update the file name with '_' instead of spaces. To keep the master header at the top of cbfs, add a placeholder. This removes the need to handle the cbfs master header in cbfstool. This functionality will be dropped in a later CL. On x86 reserve some space in the linker script to add the pointer. On non-x86 generate a pointer inside a C struct file. As a bonus this would actually fix the master header pointer mechanism on Intel/APL as only the bootblock inside IFWI gets memory mapped. TESTED on thinkpad X201: SeaBIOS correctly finds the cbfs master header. Change-Id: I3ba01be7da1f09a8cac287751497c18cda97d293 Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/59132 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Raul Rangel <rrangel@chromium.org>
2022-05-11sec/intel/txt: Use 'bios_acm_error' variableArthur Heymans
Use the variable intended for this use. This fixes building with clang. Change-Id: I4ee61fb9533b90ddb1a1592d5d9945761739ddb6 Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/63062 Reviewed-by: Angel Pons <th3fanbus@gmail.com> Reviewed-by: Paul Menzel <paulepanter@mailbox.org> Reviewed-by: Patrick Rudolph <siro@das-labor.org> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2022-05-11security/tpm/crtm.c: Remove set but unused variableArthur Heymans
Change-Id: I3c97cb57fe13adee217783973691748d6c542abe Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/63070 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Angel Pons <th3fanbus@gmail.com> Reviewed-by: Julius Werner <jwerner@chromium.org>
2022-04-24{drivers,northbridge,security}: Remove unused <cpu/x86/lapic.h>Elyes HAOUAS
Found using: diff <(git grep -l '#include <cpu/x86/lapic.h>' -- src/) <(git grep -l 'xapic_read\|xapic_write\|xapic_send_ipi\|xapic_busy\|x2apic_read\|x2apic_write\|x2apic_send_ipi\|is_x2apic_mode\|lapic_read\|lapic_write\|lapic_update32\|lapic_send_ipi\|lapic_busy\|initial_lapicid\|lapicid\|stop_this_cpu\|enable_lapic\|disable_lapic\|setup_lapic' -- src/) |grep ">" Change-Id: Ie8fcf61a0604281c23cd3f589f1aa0cdbbd9366b Signed-off-by: Elyes HAOUAS <ehaouas@noos.fr> Reviewed-on: https://review.coreboot.org/c/coreboot/+/61048 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Martin L Roth <martinroth@google.com>
2022-04-24src: Remove unused <console/cbmem_console.h>Elyes HAOUAS
Found using: diff <(git grep -l '#include <console/cbmem_console.h>' -- src/) <(git grep -l 'cbmemc_init\|cbmemc_tx_byte\|cbmem_dump_console' -- src/) |grep "<" Change-Id: I24a6ab7420e079769e19793848c92c187529e253 Signed-off-by: Elyes HAOUAS <ehaouas@noos.fr> Reviewed-on: https://review.coreboot.org/c/coreboot/+/60913 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Martin L Roth <martinroth@google.com>
2022-04-21tpm: Refactor TPM Kconfig dimensionsJes B. Klinke
Break TPM related Kconfig into the following dimensions: TPM transport support: config CRB_TPM config I2C_TPM config SPI_TPM config MEMORY_MAPPED_TPM (new) TPM brand, not defining any of these is valid, and result in "generic" support: config TPM_ATMEL (new) config TPM_GOOGLE (new) config TPM_GOOGLE_CR50 (new, implies TPM_GOOGLE) config TPM_GOOGLE_TI50 (new to be used later, implies TPM_GOOGLE) What protocol the TPM chip supports: config MAINBOARD_HAS_TPM1 config MAINBOARD_HAS_TPM2 What the user chooses to compile (restricted by the above): config NO_TPM config TPM1 config TPM2 The following Kconfigs will be replaced as indicated: config TPM_CR50 -> TPM_GOOGLE config MAINBOARD_HAS_CRB_TPM -> CRB_TPM config MAINBOARD_HAS_I2C_TPM_ATMEL -> I2C_TPM && TPM_ATMEL config MAINBOARD_HAS_I2C_TPM_CR50 -> I2C_TPM && TPM_GOOGLE config MAINBOARD_HAS_I2C_TPM_GENERIC -> I2C_TPM && !TPM_GOOGLE && !TPM_ATMEL config MAINBOARD_HAS_LPC_TPM -> MEMORY_MAPPED_TPM config MAINBOARD_HAS_SPI_TPM -> SPI_TPM && !TPM_GOOGLE && !TPM_ATMEL config MAINBOARD_HAS_SPI_TPM_CR50 -> SPI_TPM && TPM_GOOGLE Signed-off-by: Jes B. Klinke <jbk@chromium.org> Change-Id: I4656b2b90363b8dfd008dc281ad591862fe2cc9e Reviewed-on: https://review.coreboot.org/c/coreboot/+/63424 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Yu-Ping Wu <yupingso@google.com> Reviewed-by: Tim Wawrzynczak <twawrzynczak@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
2022-03-09{drivers/security}: Replace `cb_err_t` with `enum cb_err`Subrata Banik
This patch replaces remaining `cb_err_t` with `enum cb_err` after commit hash 69cc557c (commonlib/bsd: Remove cb_err_t) removes majority of `cb_err_t` instances. TEST=Able to build the brya. Signed-off-by: Subrata Banik <subratabanik@google.com> Change-Id: I3392f9c2cfb4a889a999c8ea25066c89979f0900 Reviewed-on: https://review.coreboot.org/c/coreboot/+/62676 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Werner Zeh <werner.zeh@siemens.com> Reviewed-by: Eric Lai <eric_lai@quanta.corp-partner.google.com> Reviewed-by: Arthur Heymans <arthur@aheymans.xyz>
2022-03-09commonlib/bsd: Remove cb_err_tJulius Werner
cb_err_t was meant to be used in place of `enum cb_err` in all situations, but the choice to use a typedef here seems to be controversial. We should not be arbitrarily using two different identifiers for the same thing across the codebase, so since there are no use cases for serializing enum cb_err at the moment (which would be the primary reason to typedef a fixed-width integer instead), remove cb_err_t again for now. Signed-off-by: Julius Werner <jwerner@chromium.org> Change-Id: Iaec36210d129db26d51f0a105d3de070c03b686b Reviewed-on: https://review.coreboot.org/c/coreboot/+/62600 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Yu-Ping Wu <yupingso@google.com> Reviewed-by: Tim Wawrzynczak <twawrzynczak@chromium.org>
2022-03-08timestamps: Rename timestamps to make names more consistentJakub Czapiga
This patch aims to make timestamps more consistent in naming, to follow one pattern. Until now there were many naming patterns: - TS_START_*/TS_END_* - TS_BEFORE_*/TS_AFTER_* - TS_*_START/TS_*_END This change also aims to indicate, that these timestamps can be used to create time-ranges, e.g. from TS_BOOTBLOCK_START to TS_BOOTBLOCK_END. Signed-off-by: Jakub Czapiga <jacz@semihalf.com> Change-Id: I533e32392224d9b67c37e6a67987b09bf1cf51c6 Reviewed-on: https://review.coreboot.org/c/coreboot/+/62019 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Tim Wawrzynczak <twawrzynczak@chromium.org> Reviewed-by: Yu-Ping Wu <yupingso@google.com> Reviewed-by: Raul Rangel <rrangel@chromium.org>
2022-03-08device/mmio.h: Move readXp/writeXp helpers to device/mmio.hJianjun Wang
These helpers are not architecture dependent and it might be used for different platform. Signed-off-by: Jianjun Wang <jianjun.wang@mediatek.com> Change-Id: Ic13a94d91affb7cf65a2f22f08ea39ed671bc8e8 Reviewed-on: https://review.coreboot.org/c/coreboot/+/62561 Reviewed-by: Yu-Ping Wu <yupingso@google.com> Reviewed-by: Angel Pons <th3fanbus@gmail.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2022-03-07drivers/tpm/spi: Refactor out some cr50-specific logicTim Wawrzynczak
Mainboards accessing the cr50 over an I2C bus may want to reuse some of the same firmware version and BOARD_CFG logic, therefore refactor this logic out into a bus-agnostic file, drivers/tpm/cr50.c. This file uses the new tis_vendor_read/write() functions in order to access the cr50 regardless of the bus which is physically used. In order to leave SPI devices intact, the tis_vendor_* functions are added to the SPI driver. BUG=b:202246591 TEST=boot to OS on google/dratini, see the same FW version and board_cfg console prints as before the change. Signed-off-by: Tim Wawrzynczak <twawrzynczak@chromium.org> Change-Id: Ie68618cbe026a2b9221f93d0fe41d0b2054e8091 Reviewed-on: https://review.coreboot.org/c/coreboot/+/61977 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Subrata Banik <subratabanik@google.com>
2022-03-01security/tpm: Add vendor-specific tis functions to read/write TPM regsTim Wawrzynczak
In order to abstract bus-specific logic from TPM logic, the prototype for two vendor-specific tis functions are added in this patch. tis_vendor_read() can be used to read directly from TPM registers, and tis_vendor_write() can be used to write directly to TPM registers. Signed-off-by: Tim Wawrzynczak <twawrzynczak@chromium.org> Change-Id: I939cf5b6620b6f5f6d454c53fcaf37c153702acc Reviewed-on: https://review.coreboot.org/c/coreboot/+/62058 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
2022-02-24security/intel/stm: Make STM setup MP safeEugene Myers
Some processor families allow for SMM setup to be done in parallel. On processors that have this feature, the BIOS resource list becomes unusable for some processors during STM startup. This patch covers two cases: (1) The BIOS resource list becomes twice as long because the smm_relocation function is called twice - this is resolved by recreating the list on each invocation. (2) Not all processors receive the correct resource list pointer - this is resolved by having every processor execute the pointer calculation code, which is a lot faster then forcing all processors to spin lock waiting for this value to be calculated. This patch has been tested on a Purism L1UM-1X8C and Purism 15v4. Signed-off-by: Eugene Myers <cedarhouse@comcast.net> Change-Id: I7619038edc78f306bd7eb95844bd1598766f8b37 Reviewed-on: https://review.coreboot.org/c/coreboot/+/61689 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Eugene Myers <cedarhouse1@comcast.net> Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
2022-02-24security/intel/stm: Use correct SMBASE for SMM descriptor setupEugene Myers
Commit ea3376c (SMM module loader version 2) changedhow the SMBASE is calculated. This patch modifies setup_smm_descriptor to properly acquire the SMBASE. This patch has been tested on a Purism L1UM-1X8C and a Purism 15v4. Signed-off-by: Eugene Myers <cedarhouse@comcast.net> Change-Id: I1d62a36cdcbc20a19c42266164e612fb96f91953 Reviewed-on: https://review.coreboot.org/c/coreboot/+/61688 Reviewed-by: Eugene Myers <cedarhouse1@comcast.net> Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2022-02-07treewide: Remove "ERROR: "/"WARN: " prefixes from log messagesJulius Werner
Now that the console system itself will clearly differentiate loglevels, it is no longer necessary to explicitly add "ERROR: " in front of every BIOS_ERR message to help it stand out more (and allow automated tooling to grep for it). Removing all these extra .rodata characters should save us a nice little amount of binary size. This patch was created by running find src/ -type f -exec perl -0777 -pi -e 's/printk\(\s*BIOS_ERR,\s*"ERROR: /printk\(BIOS_ERR, "/gi' '{}' ';' and doing some cursory review/cleanup on the result. Then doing the same thing for BIOS_WARN with 's/printk\(\s*BIOS_WARNING,\s*"WARN(ING)?: /printk\(BIOS_WARNING, "/gi' Signed-off-by: Julius Werner <jwerner@chromium.org> Change-Id: I3d0573acb23d2df53db6813cb1a5fc31b5357db8 Reviewed-on: https://review.coreboot.org/c/coreboot/+/61309 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: HAOUAS Elyes <ehaouas@noos.fr> Reviewed-by: Lance Zhao Reviewed-by: Jason Glenesk <jason.glenesk@gmail.com>
2022-01-13console/cbmem_console: Rename cbmem_dump_consoleRaul E Rangel
This function actually dumps cbmem to the UART. This change renames the function to make that clear. BUG=b:213828947 TEST=Build guybrush Signed-off-by: Raul E Rangel <rrangel@chromium.org> Change-Id: Icc314c530125e5303a06b92aab48c1e1122fd18c Reviewed-on: https://review.coreboot.org/c/coreboot/+/61010 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
2022-01-12src: Remove redundant <rules.h> and <commonlib/bsd/compiler.h>Elyes HAOUAS
<rules.h> and <commonlib/bsd/compiler.h> are always automatically included in all compilation units by the build system Change-Id: I9528c47f4b7cd22c5a56d6a59b3bfe53197cc4d8 Signed-off-by: Elyes HAOUAS <ehaouas@noos.fr> Reviewed-on: https://review.coreboot.org/c/coreboot/+/60932 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Felix Held <felix-coreboot@felixheld.de>
2022-01-04security/memory/memory.c: Include 'stdbool' instead of 'stdint'Elyes HAOUAS
Change-Id: I4eac157c8b48c1c10178bb84822b6462c245deca Signed-off-by: Elyes HAOUAS <ehaouas@noos.fr> Reviewed-on: https://review.coreboot.org/c/coreboot/+/60550 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Angel Pons <th3fanbus@gmail.com> Reviewed-by: Felix Singer <felixsinger@posteo.net>
2022-01-01src: Drop duplicated includesElyes HAOUAS
<types.h> already provides <commonlib/bsd/cb_err.h>, <limits.h>, <stdbool.h>, <stdint.h> and <stddef.h> headers. Change-Id: I700b3f0e864ecce3f8b3b66f3bf6c8f1040acee1 Signed-off-by: Elyes HAOUAS <ehaouas@noos.fr> Reviewed-on: https://review.coreboot.org/c/coreboot/+/60437 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
2021-12-16Revert "security/vboot: Add NVRAM counter for TPM 2.0"Tim Wawrzynczak
This reverts commit 7dce19080889955576f8fd197658077aced96a96. Reason for revert: Unable to boot in factory mode Change-Id: I1b51010080164c6e28d77a932f77c10006fd4153 Signed-off-by: Tim Wawrzynczak <twawrzynczak@chromium.org> Reviewed-on: https://review.coreboot.org/c/coreboot/+/60030 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Julius Werner <jwerner@chromium.org> Reviewed-by: Raul Rangel <rrangel@chromium.org> Reviewed-by: Karthik Ramasubramanian <kramasub@google.com>
2021-12-06x86_64 assembly: Don't touch %gsPatrick Rudolph
With CPU_INFO_V2 enabled %gs holds the pointer to the cpu_info struct, so don't clobber it. Backup and restore %gs where possible. Fixes a crash in MPinit seen after calling FSP-S. Change-Id: If9fc999b34530de5d8b6ad27b9af25fc552e9420 Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/59764 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Arthur Heymans <arthur@aheymans.xyz>
2021-12-06security/intel: Use defines for segment registersPatrick Rudolph
Change-Id: I6f11039bafa3800d59d61defa8824ae962224c9b Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/59763 Reviewed-by: Paul Menzel <paulepanter@mailbox.org> Reviewed-by: Angel Pons <th3fanbus@gmail.com> Reviewed-by: Arthur Heymans <arthur@aheymans.xyz> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-12-06cbfs: Remove deprecated APIsJulius Werner
This patch removes all remaining pieces of the old CBFS API, now that the last straggling use cases of it have been ported to the new one (meaning cbfs_map()/cbfs_load()/etc... see CB:39304 and CB:38421). Signed-off-by: Julius Werner <jwerner@chromium.org> Change-Id: I1cec0ca2d9d311626a087318d1d78163243bfc3c Reviewed-on: https://review.coreboot.org/c/coreboot/+/59682 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Raul Rangel <rrangel@chromium.org> Reviewed-by: Yu-Ping Wu <yupingso@google.com> Reviewed-by: Werner Zeh <werner.zeh@siemens.com>
2021-12-03cbfs | tspi: Join hash calculation for verification and measurementJulius Werner
This patch moves the CBFS file measurement when CONFIG_TPM_MEASURED_BOOT is enabled from the lookup step into the code where a file is actually loaded or mapped from flash. This has the advantage that CBFS routines which just look up a file to inspect its metadata (e.g. cbfs_get_size()) do not cause the file to be measured twice. It also removes the existing inefficiency that files are loaded twice when measurement is enabled (once to measure and then again when they are used). When CBFS verification is enabled and uses the same hash algorithm as the TPM, we are even able to only hash the file a single time and use the result for both purposes. Signed-off-by: Julius Werner <jwerner@chromium.org> Change-Id: I70d7066c6768195077f083c7ffdfa30d9182b2b7 Reviewed-on: https://review.coreboot.org/c/coreboot/+/59681 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Raul Rangel <rrangel@chromium.org>
2021-12-03src/security/vboot: Set up secure counter space in TPM NVRAMKarthikeyan Ramasubramanian
High Definition (HD) protected content playback requires secure counters that are updated at regular interval while the protected content is playing. To support similar use-cases, define space for secure counters in TPM NVRAM and initialize them. These counters are defined once during the factory initialization stage. Also add VBOOT_DEFINE_WIDEVINE_COUNTERS config item to enable these secure counters only on the mainboard where they are required/used. BUG=b:205261728 TEST=Build and boot to OS in guybrush. Ensure that the secure counters are defined successfully in TPM NVRAM space. tlcl_define_space: response is 0 tlcl_define_space: response is 0 tlcl_define_space: response is 0 tlcl_define_space: response is 0 On reboot if forced to redefine the space, it is identified as already defined. tlcl_define_space: response is 14c define_space():219: define_space: Secure Counter space already exists tlcl_define_space: response is 14c define_space():219: define_space: Secure Counter space already exists tlcl_define_space: response is 14c define_space():219: define_space: Secure Counter space already exists tlcl_define_space: response is 14c define_space():219: define_space: Secure Counter space already exists Change-Id: I915fbdada60e242d911b748ad5dc28028de9b657 Signed-off-by: Karthikeyan Ramasubramanian <kramasub@google.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/59476 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Raul Rangel <rrangel@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
2021-12-02security/intel/txt: Fix HEAP_ACM format depending on number of ACMs in CBFSMichał Żygowski
Since we may have either BIOS ACM or both BIOS and SINIT ACMs in CBFS, the size of txt_heap_acm_element will be different. We cannot always hardcode the size of ACM addresses array for two ACMs. If only the BIOS ACM was included, the BDR parsing failed in TBoot due to invalid size of HEAP_ACM element. Check if SINIT ACM is present in CBFS and push properly formatted BDR region onto the TXT heap. Use two separate txt_heap_acm_element structures with different lengths. TEST=Boot QubesOS 4.0 with TBoot 1.8.2 on Dell OptiPlex 9010 with and without SINIT ACM in CBFS and see that TBoot no longer complains on the wrong size of HEAP_ACM element Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com> Change-Id: Ib0c37a66d96e1ca3fb4d3f665e3ad35c6f1c5c1e Reviewed-on: https://review.coreboot.org/c/coreboot/+/59519 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2021-11-27security/intel/txt: Fix GETSEC checks in romstageMichał Żygowski
IA32_FEATURE_CONTROL does not need to be checked by BIOS, in fact these bits are needed only by SENTER and SINIT ACM. ACM ENTERACCS does not check these bits according to Intel SDM. Also noticed that the lock bit of IA32_FEATURE_CONTROL cannot be cleared by issuing neither global reset nor full reset on Sandybridge/Ivybridge platforms which results in a reset loop. However, check the IA32_FEATURE_CONTROL SENTER bits in ramstage where the register is properly set on all cores already. TEST=Run ACM SCLEAN on Dell OptiPlex 9010 with i7-3770/Q77 Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com> Change-Id: Ie9103041498f557b85019a56e1252090a4fcd0c9 Reviewed-on: https://review.coreboot.org/c/coreboot/+/59520 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Patrick Rudolph <siro@das-labor.org>
2021-11-27security/intel/txt: Allow platforms without FIT to use Intel TXTMichał Żygowski
There is no real code or feature dependency on CPU_INTEL_FIRMWARE_INTERFACE_TABLE for Intel TXT. Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com> Change-Id: I2858c8de9396449a0ee30837a98fab05570a6259 Reviewed-on: https://review.coreboot.org/c/coreboot/+/59518 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2021-11-27security/intel/txt: Issue a global reset when TXT_RESET bit is setMichał Żygowski
Although TXT specification says to do power cycle reset if TXT_RESET is set, all Intel provided implementations issue a global reset here. TEST=Perform ungraceful shutdown after SENTER to trigger SCLEAN path on Dell OptiPlex 9010 and successfully call ACM SCLEAN. Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com> Change-Id: I8ee2400fab20857ff89b14bb7b662a938b775304 Reviewed-on: https://review.coreboot.org/c/coreboot/+/59639 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2021-11-27security/intel/txt: Use set_global_reset in txt_reset_platform if possibleMichał Żygowski
Allow to set global reset bits on other platforms which enable SOUTHBRIDGE_INTEL_COMMON_ME. In certain Intel TXT flows global reset instead of full power cycle reset is needed. Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com> Change-Id: I561458044860ee5a26f7d61bcff1c407fa1533f2 Reviewed-on: https://review.coreboot.org/c/coreboot/+/59517 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2021-11-27security/intel/txt: Implement GETSEC PARAMETER dumpingMichał Żygowski
Currently there is only a function that dumps GETSEC CAPABILITIES. Add dumping GETSEC PARAMETER for completeness and additional debug information. Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com> Change-Id: I3b2c8337a8d86000a5b43788840d15146b662598 Reviewed-on: https://review.coreboot.org/c/coreboot/+/59516 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Arthur Heymans <arthur@aheymans.xyz>
2021-11-27security/intel/txt: Remove unused region deviceMichał Żygowski
Region device is no longer used to locate BIOS ACM. Use new CBFS API to map and unmap the file. Using rdev_munmap on the uninitialized region device variable causes the platform to jump to a random address. TEST=Dell OptiPlex 9010 does not raise #UD exception when Intel TXT is enabled, ACM SCHECK is successful Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com> Change-Id: I98afba35403d5d2cd9eeb7df6d1ca0171894e9d4 Reviewed-on: https://review.coreboot.org/c/coreboot/+/59515 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-by: Angel Pons <th3fanbus@gmail.com> Reviewed-by: Patrick Rudolph <siro@das-labor.org>
2021-11-27security/intel/txt: Correct reporting of chipset production fuse stateMichał Żygowski
Implement the chipset production fuse state reporting as described in the Intel TXT Software Development Guide. Also fix all occurrences where the production fuse state is checked. TEST=Dell OptiPlex 9010 with i7-3770/Q77 reports the chipset is production fused Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com> Change-Id: Ic86c5a9e1d162630a1cf61435d1014edabf104b0 Reviewed-on: https://review.coreboot.org/c/coreboot/+/59514 Reviewed-by: Patrick Rudolph <siro@das-labor.org> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-11-26security/intel/txt: Allow to set TXT BIOS Data Region versionMichał Żygowski
TXT BIOS Data region version is checked by Trusted Boot code. Older versions of TBoot (e.g. 1.8.2) may refuse to set up the MLE if BDR version is not known. Provide an option to set the BDR version in case an older TBoot code is used. This is very useful for platforms with TPM 1.2. TEST=Set BDR version to 4 and successfully boot QubesOS 4.0 with TBoot 1.8.2 on Dell OptiPlex 9010 Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com> Change-Id: Ic2550bd4008559bd47de9e35f8b1c7b52e6e0f5f Reviewed-on: https://review.coreboot.org/c/coreboot/+/59513 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2021-11-19security/vboot: Add NVRAM counter for TPM 2.0Miriam Polzer
Create an NVRAM counter in TPM 2.0 that survives owner clear and can be read and written without authorization. This counter allows to seal data with the TPM that can only be unsealed before the counter was incremented. It will be used during Chrome OS rollback to securely carry data across a TPM clear. Signed-off-by: Miriam Polzer <mpolzer@google.com> Change-Id: I511dba3b3461713ce20fb2bda9fced0fee6517e1 Reviewed-on: https://review.coreboot.org/c/coreboot/+/59097 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
2021-11-17security/vboot: Use default kernel secdata sizeTim Wawrzynczak
When fetching antirollback information for the kernel, it is not always known ahead of time what the current size of the kernel secdata area is. If the incorrect size is passed, the TPM will return back the correct size, but at the cost of an extra transaction; when using cr50 over I2C, this can be as much as 20ms. Currently, the first attempt uses the minimium size (aka version 0 or 0.2), and if another size is used (which is the case for all modern cr50-based boards, version 1 or 1.0), then a transaction is wasted on every boot. Therefore, change the default size sent to the TPM to be the default one used in the VB2 API instead of the minimum one. BUG=b:201304784 TEST=verify TPM initialization time drops by ~20ms. Also the Kernel NV Index is read correctly in the BIOS logs. src/security/tpm/tss/tcg-2.0/tss.c:231 index 0x1007 return code 0 src/security/tpm/tss/tcg-2.0/tss.c:231 index 0x1008 return code 0 504:finished TPM initialization 99,953 (65,606) Change-Id: I22d9c0079bb1175f24ff7317d116e79aa5ba08ed Signed-off-by: Tim Wawrzynczak <twawrzynczak@chromium.org> Signed-off-by: Karthikeyan Ramasubramanian <kramasub@google.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/58669 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Yu-Ping Wu <yupingso@google.com> Reviewed-by: Julius Werner <jwerner@chromium.org> Reviewed-by: Raul Rangel <rrangel@chromium.org>
2021-11-17security/tpm/tcg-2.0: Handle TPM_RC_NV_RANGE return codeKarthikeyan Ramasubramanian
As per the TPM spec, if offset and the size field of data add to a value that is greater than the dataSize field of the NV Index referenced by nvIndex, the TPM shall return an error (TPM_RC_NV_RANGE). Handle the TPM error and map it to an appropriate vboot error. BUG=None TEST=Build and boot to OS in Guybrush. Signed-off-by: Karthikeyan Ramasubramanian <kramasub@google.com> Change-Id: I8b403e2f33cc1368065cc21f73df1102695f73eb Reviewed-on: https://review.coreboot.org/c/coreboot/+/59134 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Yu-Ping Wu <yupingso@google.com> Reviewed-by: Tim Wawrzynczak <twawrzynczak@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org> Reviewed-by: Raul Rangel <rrangel@chromium.org>
2021-11-15Reland "vboot_logic: Set VB2_CONTEXT_EC_TRUSTED in verstage_main"Hsuan-ting Chen
This reverts commit adb393bdd6cd6734fa2672bd174aca4588a68016. This relands commit 6260bf712a836762b18d80082505e981e040f4bc. Reason for revert: The original CL did not handle some devices correctly. With the fixes: * commit 36721a4 (mb/google/brya: Add GPIO_IN_RW to all variants' early GPIO tables) * commit 3bfe46c (mb/google/guybrush: Add GPIO EC in RW to early GPIO tables) * commit 3a30cf9 (mb/google/guybrush: Build chromeos.c in verstage This CL also fix the following platforms: * Change to always trusted: cyan. * Add to early GPIO table: dedede, eve, fizz, glados, hatch, octopus, poppy, reef, volteer. * Add to both Makefile and early GPIO table: zork. For mb/intel: * adlrvp: Add support for get_ec_is_trusted(). * glkrvp: Add support for get_ec_is_trusted() with always trusted. * kblrvp: Add support for get_ec_is_trusted() with always trusted. * kunimitsu: Add support for get_ec_is_trusted() and initialize it as early GPIO. * shadowmountain: Add support for get_ec_is_trusted() and initialize it as early GPIO. * tglrvp: Add support for get_ec_is_trusted() with always trusted. For qemu-q35: Add support for get_ec_is_trusted() with always trusted. We could attempt another land. Change-Id: I66b8b99d6e6bf259b18573f9f6010f9254357bf9 Signed-off-by: Hsuan Ting Chen <roccochen@chromium.org> Reviewed-on: https://review.coreboot.org/c/coreboot/+/58253 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Karthik Ramasubramanian <kramasub@google.com> Reviewed-by: Tim Wawrzynczak <twawrzynczak@chromium.org> Reviewed-by: Yu-Ping Wu <yupingso@google.com>
2021-11-10Rename ECAM-specific MMCONF KconfigsShelley Chen
Currently, the MMCONF Kconfigs only support the Enhanced Configuration Access mechanism (ECAM) method for accessing the PCI config address space. Some platforms have a different way of mapping the PCI config space to memory. This patch renames the following configs to make it clear that these configs are ECAM-specific: - NO_MMCONF_SUPPORT --> NO_ECAM_MMCONF_SUPPORT - MMCONF_SUPPORT --> ECAM_MMCONF_SUPPORT - MMCONF_BASE_ADDRESS --> ECAM_MMCONF_BASE_ADDRESS - MMCONF_BUS_NUMBER --> ECAM_MMCONF_BUS_NUMBER - MMCONF_LENGTH --> ECAM_MMCONF_LENGTH Please refer to CB:57861 "Proposed coreboot Changes" for more details. BUG=b:181098581 BRANCH=None TEST=./util/abuild/abuild -p none -t GOOGLE_KOHAKU -x -a -c max Make sure Jenkins verifies that builds on other boards Change-Id: I1e196a1ed52d131a71f00cba1d93a23e54aca3e2 Signed-off-by: Shelley Chen <shchen@google.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/57333 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Tim Wawrzynczak <twawrzynczak@chromium.org>
2021-11-01security/intel/txt: Get addr bits at runtimeArthur Heymans
This removes the need for a Kconfig value. Change-Id: Ia9f39aa1c7fb9a64c2e5412bac6e2600b222a635 Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/58684 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Angel Pons <th3fanbus@gmail.com> Reviewed-by: Nico Huber <nico.h@gmx.de>
2021-10-15Revert "vboot_logic: Set VB2_CONTEXT_EC_TRUSTED in verstage_main"Hsuan-ting Chen
This reverts commit 6260bf712a836762b18d80082505e981e040f4bc. Reason for revert: This CL did not handle Intel GPIO correctly. We need to add GPIO_EC_IN_RW into early_gpio_table for platforms using Intel SoC. Signed-off-by: Hsuan Ting Chen <roccochen@chromium.org> Change-Id: Iaeb1bf598047160f01e33ad0d9d004cad59e3f75 Reviewed-on: https://review.coreboot.org/c/coreboot/+/57951 Reviewed-by: Yu-Ping Wu <yupingso@google.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-10-07security/vboot: Remove vb2ex_hwcrypto stubsYu-Ping Wu
Now that the vb2ex_hwcrypto_* stub functions are included in vboot fwlib (CL:2353775), we can remove the same stubs from coreboot. BUG=none TEST=emerge-brya coreboot TEST=emerge-cherry coreboot BRANCH=none Change-Id: I62bdc647eb3e34c581cc1b8d15e7f271211e6156 Signed-off-by: Yu-Ping Wu <yupingso@chromium.org> Reviewed-on: https://review.coreboot.org/c/coreboot/+/58095 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Julius Werner <jwerner@chromium.org> Reviewed-by: Werner Zeh <werner.zeh@siemens.com>
2021-10-05src/mainboard to src/security: Fix spelling errorsMartin Roth
These issues were found and fixed by codespell, a useful tool for finding spelling errors. Signed-off-by: Martin Roth <martin@coreboot.org> Change-Id: Ie34003a9fdfe9f3b1b8ec0789aeca8b9435c9c79 Reviewed-on: https://review.coreboot.org/c/coreboot/+/58081 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Felix Held <felix-coreboot@felixheld.de> Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2021-09-17security/intel/txt/romstage: add missing arch/cpu.h includeFelix Held
Including arch/cpu.h is needed to have the declaration for cpu_get_feature_flags_ecx. Signed-off-by: Felix Held <felix-coreboot@felixheld.de> Change-Id: I091c82f5a55ee9aa84a255c75c7721eff989344d Reviewed-on: https://review.coreboot.org/c/coreboot/+/57726 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Raul Rangel <rrangel@chromium.org>
2021-09-16vboot_logic: Set VB2_CONTEXT_EC_TRUSTED in verstage_mainHsuan Ting Chen
vboot_reference is introducing a new field (ctx) to store the current boot mode in crrev/c/2944250 (ctx->bootmode), which will be leveraged in both vboot flow and elog_add_boot_reason in coreboot. In current steps of deciding bootmode, a function vb2ex_ec_trusted is required. This function checks gpio EC_IN_RW pin and will return 'trusted' only if EC is not in RW. Therefore, we need to implement similar utilities in coreboot. We will deprecate vb2ex_ec_trusted and use the flag, VB2_CONTEXT_EC_TRUSTED, in vboot, vb2api_fw_phase1 and set that flag in coreboot, verstage_main. Also add a help function get_ec_is_trusted which needed to be implemented per mainboard. BUG=b:177196147, b:181931817 BRANCH=none TEST=Test on trogdor if manual recovery works Signed-off-by: Hsuan Ting Chen <roccochen@chromium.org> Change-Id: I479c8f80e45cc524ba87db4293d19b29bdfa2192 Reviewed-on: https://review.coreboot.org/c/coreboot/+/57048 Reviewed-by: Yu-Ping Wu <yupingso@google.com> Reviewed-by: Tim Wawrzynczak <twawrzynczak@chromium.org> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-09-15vboot: Call check_boot_mode before vb2api_fw_phase1Daisuke Nojiri
Currently, check_boot_mode is called after vb2api_fw_phase1, which makes verstage_main exit before reaching check_boot_mode if recovery mode is manually requested. Thus, recovery mode isn't able to test whether VB2_CONTEXT_EC_TRUSTED is set or not. This patch makes verstage_main call check_boot_mode before vb2api_fw_phase1 to fix the issue. BUG=b:180927027, b:187871195 BRANCH=none TEST=build Change-Id: If8524d1513b13fd79320a116a83f6729a820f61f Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://review.coreboot.org/c/coreboot/+/57623 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
2021-07-26vboot/secdata_tpm: Add WRITE_STCLEAR attr to RW ARB spacesAseda Aboagye
It can be nice to update the TPM firmware without having to clear the TPM owner. However, in order to do so would require platformHierarchy to be enabled which would leave the kernel antirollback space a bit vulnerable. To protect the kernel antirollback space from being written to by the OS, we can use the WriteLock command. In order to do so we need to add the WRITE_STCLEAR TPM attribute. This commit adds the WRITE_STCLEAR TPM attribute to the rw antirollback spaces. This includes the kernel antirollback space along with the MRC space. When an STCLEAR attribute is set, this indicates that the TPM object will need to be reloaded after any TPM Startup (CLEAR). BUG=b:186029006 BRANCH=None TEST=Build and flash a chromebook with no kernel antirollback space set up, boot to Chrome OS, run `tpm_manager_client get_space_info --index=0x1007` and verify that the WRITE_STCLEAR attribute is present. Signed-off-by: Aseda Aboagye <aaboagye@google.com> Change-Id: I3181b4c18acd908e924ad858b677e891312423fe Reviewed-on: https://review.coreboot.org/c/coreboot/+/56358 Reviewed-by: Julius Werner <jwerner@chromium.org> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-07-14include/cpu/x86/msr: introduce IA32_MC_*(x) macrosFelix Held
When accessing the MCA MSRs, the MCA bank number gets multiplied by 4 and added to the IA32_MC0_* define to get the MSR number. Add a macro that already does this calculation to avoid open coding this repeatedly. Change-Id: I2de753b8c8ac8dcff5a94d5bba43aa13bbf94b99 Signed-off-by: Felix Held <felix-coreboot@felixheld.de> Reviewed-on: https://review.coreboot.org/c/coreboot/+/56243 Reviewed-by: Raul Rangel <rrangel@chromium.org> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-07-12security/intel/txt: use mca_get_bank_count()Felix Held
Use the common mca_get_bank_count function instead of open-coding the functionality to get the MCA bank number. Change-Id: I28244c975ee34d36d0b44df092d4a62a01c3c79c Signed-off-by: Felix Held <felix-coreboot@felixheld.de> Reviewed-on: https://review.coreboot.org/c/coreboot/+/56187 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Marshall Dawson <marshalldawson3rd@gmail.com>
2021-07-12security/intel/txt: add missing cpu/x86/msr.h includeFelix Held
msr_t and a few other things used in here are defined in cpu/x86/msr.h, so include it directly in this file. Change-Id: I7a3299381ff54b7665620861dec60642f27bac8d Signed-off-by: Felix Held <felix-coreboot@felixheld.de> Reviewed-on: https://review.coreboot.org/c/coreboot/+/56186 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Marshall Dawson <marshalldawson3rd@gmail.com>
2021-07-07Makefile.inc: Fix IFITTOOL dependenciesArthur Heymans
Add IFITTOOL as a dependency where needed and remove where it is unneeded. Change-Id: I88c9fc19cca0c72e80d3218dbcc76b89b04feacf Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/56112 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Patrick Georgi <pgeorgi@google.com>
2021-07-01vboot: add VBOOT_X86_SHA256_ACCELERATION configSubrata Banik
Add Kconfig option for VBOOT_X86_SHA256_ACCELERATION, which will use x86-sha extension for SHA256 instead of software implementation. TEST=Able to call vb2ex_hwcrypto_digest_init() and perform SHA using HW crypto engine. Change-Id: Idc8be8711c69f4ebc489cd37cc3749c0b257c610 Signed-off-by: Subrata Banik <subrata.banik@intel.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/55611 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
2021-06-28security/intel/cbnt: Fix loggingArthur Heymans
The wrong format was used. It looks like struct bitfields are of type int according to gcc so %u needs to be used and not %lu. Change-Id: I54419d722aec0d43e6f54a4bb4eb4d899c909fec Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/55847 Reviewed-by: Angel Pons <th3fanbus@gmail.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-06-25security/intel/cbnt: Remove fixed size requirementArthur Heymans
The CBnT provisioning tooling in intel-sec-tools are now cbfs aware and don't need to have a fixed size at buildtime. Tested on OCP/Deltalake with CBnT enabled. Change-Id: I446b5045fe65f51c5fa011895cd56dbd25b6ccc7 Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/55821 Reviewed-by: Angel Pons <th3fanbus@gmail.com> Reviewed-by: Christopher Meis <christopher.meis@9elements.com> Reviewed-by: Christian Walter <christian.walter@9elements.com> Reviewed-by: Kyösti Mälkki <kyosti.malkki@gmail.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-06-21security/intel: Add option to enable SMM flash access onlyAngel Pons
On platforms where the boot media can be updated externally, e.g. using a BMC, add the possibility to enable writes in SMM only. This allows to protect the BIOS region even without the use of vboot, but keeps SMMSTORE working for use in payloads. Note that this breaks flashconsole, since the flash becomes read-only. Tested on Asrock B85M Pro4 and HP 280 G2, SMM BIOS write protection works as expected, and SMMSTORE can still be used. Change-Id: I157db885b5f1d0f74009ede6fb2342b20d9429fa Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Signed-off-by: Angel Pons <th3fanbus@gmail.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/40830 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Patrick Rudolph <siro@das-labor.org>
2021-06-21security/intel/cbnt: Add loggingArthur Heymans
This decodes and logs the CBnT status and error registers. Change-Id: I8b57132bedbd944b9861ab0e2e0d14723cb61635 Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/54093 Reviewed-by: Angel Pons <th3fanbus@gmail.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-06-21security/intel/txt: Split off microcode error types string printingArthur Heymans
The purpose is to reuse the types string in CBnT error printing. Change-Id: I435de402fef6d4702c9c7250c8bd31243a04a46e Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/54092 Reviewed-by: Angel Pons <th3fanbus@gmail.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-06-21security/intel/txt: Always build logging.cArthur Heymans
Always building makes sure this code gets buildtested. Calling this code already was guarded by "if CONFIG(INTEL_TXT_LOGGING)". Also build this in all stages as future code will use this in bootblock. Change-Id: I654adf16b47513e3279335c8a8ad48b9371d438e Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/54295 Reviewed-by: Angel Pons <th3fanbus@gmail.com> Reviewed-by: Christian Walter <christian.walter@9elements.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-06-21security/intel/cbnt/Makefile.inc: Fix building cbnt-provArthur Heymans
This makes it possible to build cbnt-prov with Jenkins. Change-Id: I658723a4e10bff45176d7c1ea7a410edbb182dc6 Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/55667 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2021-06-21security/tpm/tspi/crtm.c: Fix early initArthur Heymans
If the early crtm is not initialised there is nothing to write to PCR in the early tpm init. Change-Id: I9fa05f04588321163afc817de29c03bd426fc1f0 Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/55470 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Johnny Lin <Johnny_Lin@wiwynn.com> Reviewed-by: Angel Pons <th3fanbus@gmail.com> Reviewed-by: Christian Walter <christian.walter@9elements.com> Reviewed-by: Julius Werner <jwerner@chromium.org>
2021-06-16security/tpm/tspi: Reduce scope of tspi_init_crtmArthur Heymans
This is only called locally. Change-Id: Ie3eaf659a2868eee1d4688885495c413f94f42e2 Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/55469 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Johnny Lin <Johnny_Lin@wiwynn.com> Reviewed-by: Angel Pons <th3fanbus@gmail.com> Reviewed-by: Christian Walter <christian.walter@9elements.com>
2021-06-15tpm/tss: Remove local variablePatrick Georgi
Depending on how the "middle-end" (yes, the gcc developers are serious about that) optimizer ends up mangling the code, there may or may not be a complaint about x being used uninitialized when it's clearly not used at all. So instead, why keep x in the first place? memcpy(foo, NULL, 0) is the same as memcpy(foo, some_uninitialized_variable, 0) in that it does nothing. Change-Id: Ib0a97c3e3fd1a2a6aff37da63376373c88ac595d Signed-off-by: Patrick Georgi <pgeorgi@google.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/55499 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2021-06-14security/vboot: Add timestamps when loading verstageRaul E Rangel
We are not currently tracking how long it takes to load verstage. The enum values already exist, they just weren't used. BUG=b:179092979 TEST=Dump timestamps 501:starting to load verstage 2,280,656 (1) 502:finished loading verstage 2,340,845 (60,189) Signed-off-by: Raul E Rangel <rrangel@chromium.org> Change-Id: I2cde58cb8aa796829a4e054e6925e2394973484b Reviewed-on: https://review.coreboot.org/c/coreboot/+/55370 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Julius Werner <jwerner@chromium.org> Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2021-06-10security/vboot: Add support for ZTE spacesAseda Aboagye
This commit adds support for the Chrome OS Zero-Touch Enrollment related spaces. For TPM 2.0 devices which don't use Cr50, coreboot will define the RMA+SN Bits, Board ID, and RMA Bytes counter spaces. The RMA+SN Bits space is 16 bytes initialized to all 0xFFs. The Board ID space is 12 bytes initialized to all 0xFFs. The RMA Bytes counter space is 8 bytes intialized to 0. BUG=b:184676425 BRANCH=None TEST=Build and flash lalala, verify that the ZTE spaces are created successfully by undefining the firmware antirollback space in the TPM such that the TPM undergoes factory initialization in coreboot. Reboot the DUT. Boot to CrOS and run `tpm_manager_client list_spaces` and verify that the ZTE spaces are listed. Run `tpm_manager_client read_space` with the various indices and verify that the sizes and initial values of the spaces are correct. TEST=Attempt to undefine the ZTE spaces and verify that it fails due to the unsatisfiable policy. Signed-off-by: Aseda Aboagye <aaboagye@google.com> Change-Id: I97e3ae7e18fc9ee9a02afadbbafeb226b41af0eb Reviewed-on: https://review.coreboot.org/c/coreboot/+/55242 Reviewed-by: Julius Werner <jwerner@chromium.org> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-06-10security/tpm/tss/tcg-2.0: Add `tlcl_set_bits()`Aseda Aboagye
This commit adds support for the TPM2_NV_SetBits command to the TLCL. This command is used to set bits in an NV index that was created as a bit field. Any number of bits from 0 to 64 may be set. The contents of bits are ORed with the current contents of the NV index. The following is an excerpt from lalala undergoing TPM factory initialization which exercises this function in a child commit: ``` antirollback_read_space_firmware():566: TPM: Not initialized yet. factory_initialize_tpm():530: TPM: factory initialization tlcl_self_test_full: response is 0 tlcl_force_clear: response is 0 tlcl_define_space: response is 14c define_space():197: define_space: kernel space already exists tlcl_write: response is 0 tlcl_define_space: response is 14c define_space():197: define_space: RO MRC Hash space already exists tlcl_write: response is 0 tlcl_define_space: response is 14c define_space():197: define_space: FWMP space already exists tlcl_write: response is 0 tlcl_define_space: response is 0 tlcl_write: response is 0 tlcl_define_space: response is 0 tlcl_write: response is 0 tlcl_define_space: response is 0 tlcl_set_bits: response is 0 tlcl_define_space: response is 0 tlcl_write: response is 0 factory_initialize_tpm():553: TPM: factory initialization successful ``` BUG=b:184676425 BRANCH=None TEST=With other changes, create a NVMEM space in a TPM 2.0 TPM with the bits attribute. Issue the command and verify that the TPM command succeeds. Signed-off-by: Aseda Aboagye <aaboagye@google.com> Change-Id: I6ca6376bb9f7ed8fd1167c2c80f1e8d3c3f46653 Reviewed-on: https://review.coreboot.org/c/coreboot/+/55241 Reviewed-by: Aaron Durbin <adurbin@chromium.org> Reviewed-by: Bob Moragues <moragues@google.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-06-10vboot: Assign 2 to EC_EFS_BOOT_MODE_TRUSTED_RODaisuke Nojiri
This patch assings 2 to EC_EFS_BOOT_MODE_TRUSTED_RO to make coreboot set VB2_CONTEXT_EC_TRUSTED when the GSC reports TRUSTED_RO. Old GSC doesn't use 2. So, the new BIOS won't mistakenly set VB2_CONTEXT_EC_TRUSTED. BUG=b:180927027, b:187871195 BRANCH=none TEST=build Change-Id: I11a09d0035a4bd59f80018c647ca17e3318be81e Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Reviewed-on: https://review.coreboot.org/c/coreboot/+/55373 Reviewed-by: Julius Werner <jwerner@chromium.org> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-06-073rdparty/intel-sec-tools: Update to support Boot GuardChristopher Meis
Update intel-sec-tools to commit of BootGuard support. Remove --coreboot argument in src/security/intel/cbnt/Makefile.inc: was removed as argument for cbnt Change-Id: Iaf34bdb65a5f067d1d632e35d340b8fc49aaf318 Signed-off-by: Christopher Meis <christopher.meis@9elements.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/55013 Reviewed-by: Christian Walter <christian.walter@9elements.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-06-04vboot: Add VB2_CONTEXT_EC_TRUSTEDDaisuke Nojiri
This patch makes coreboot set VB2_CONTEXT_EC_TRUSTED based on the EC"s boot mode. Vboot will check VB2_CONTEXT_EC_TRUSTED to determine whether it can enter recovery mode or not. BUG=b:180927027, b:187871195 BRANCH=none TEST=build Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org> Change-Id: I9fa09dd7ae5baa1efb4e1ed4f0fe9a6803167c93 Reviewed-on: https://review.coreboot.org/c/coreboot/+/54099 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Julius Werner <jwerner@chromium.org> Reviewed-by: Furquan Shaikh <furquan@google.com>
2021-05-30Apply more uses for Kconfig TPMKyösti Mälkki
Change-Id: I54b296563940cd46fe9da9fe789b746f2fc1987d Signed-off-by: Kyösti Mälkki <kyosti.malkki@gmail.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/55016 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Aaron Durbin <adurbin@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org> Reviewed-by: Paul Menzel <paulepanter@mailbox.org>
2021-05-27tpm: Remove USER_TPMx options, make TPM1/TPM2 menuconfig visibleJulius Werner
We would like to have an easy way to completely disable TPM support on a board. For boards that don't pre-select a TPM protocol via the MAINBOARD_HAS_TPMx options, this is already possible with the USER_NO_TPM option. In order to make this available for all boards, this patch just removes the whole USER_TPMx option group and directly makes the TPM1 and TPM2 options visible to menuconfig. The MAINBOARD_HAS_TPMx options can still be used to select defaults and to prevent selection of a protocol that the TPM is known to not support, but the NO_TPM option always remains available. Also fix some mainboards that selected TPM2 directly, which they're not supposed to do (that's what MAINBOARD_HAS_TPM2 is for), and add a missing dependency to TPM_CR50 so it is set correctly for a NO_TPM scenario. Signed-off-by: Julius Werner <jwerner@chromium.org> Change-Id: Ib0a73da3c42fa4e8deffecb53f29ee38cbb51a93 Reviewed-on: https://review.coreboot.org/c/coreboot/+/54641 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Aaron Durbin <adurbin@chromium.org> Reviewed-by: Christian Walter <christian.walter@9elements.com>
2021-05-26Add Kconfig TPMKyösti Mälkki
Defined as TPM1 || TPM2. Change-Id: I18c26d6991c2ccf782a515a8e90a3eb82b53b0e6 Signed-off-by: Kyösti Mälkki <kyosti.malkki@gmail.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/54853 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Julius Werner <jwerner@chromium.org> Reviewed-by: Arthur Heymans <arthur@aheymans.xyz>
2021-05-21security/tpm/tspi: Always measure the cache to pcrArthur Heymans
Most of the time when INIT_BOOTBLOCK is selected, the cache should be empty here anyway, so this is a no-op. But when it's not empty that means the bootblock loaded some other file before it got to the TPM init part (which is possible, for example, if hooks like bootblock_soc_init() load something). Change-Id: I4aea86c094abc951d7670838f12371fddaffaa90 Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/54717 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Angel Pons <th3fanbus@gmail.com> Reviewed-by: Julius Werner <jwerner@chromium.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-08 15:03:44 +0000