From 5c808e03e2d80edd9ecd6a2a9268152b477940b6 Mon Sep 17 00:00:00 2001 From: Werner Zeh Date: Thu, 19 May 2022 09:16:28 +0200 Subject: security/tpm/crtm: Add a function to measure the bootblock on SoC level On platforms where the bootblock is not included in CBFS anymore (because it is part of another firmware section (IFWI or a different CBFS), the CRTM measurement fails. This patch adds a new function to provide a way at SoC level to measure the bootblock. Following patches will add functionality to retrieve the bootblock from the SoC related location and measure it from there. In this way the really executed code will be measured. Change-Id: I6d0da1e95a9588eb5228f63151bb04bfccfcf04b Signed-off-by: Werner Zeh Reviewed-on: https://review.coreboot.org/c/coreboot/+/64492 Tested-by: build bot (Jenkins) Reviewed-by: Arthur Heymans --- src/soc/amd/common/block/cpu/noncar/Makefile.inc | 1 + src/soc/amd/common/block/cpu/noncar/bootblock_measure.c | 8 ++++++++ 2 files changed, 9 insertions(+) create mode 100644 src/soc/amd/common/block/cpu/noncar/bootblock_measure.c (limited to 'src/soc/amd/common/block/cpu/noncar') diff --git a/src/soc/amd/common/block/cpu/noncar/Makefile.inc b/src/soc/amd/common/block/cpu/noncar/Makefile.inc index 71927961db..2ffe52b361 100644 --- a/src/soc/amd/common/block/cpu/noncar/Makefile.inc +++ b/src/soc/amd/common/block/cpu/noncar/Makefile.inc @@ -3,6 +3,7 @@ ifeq ($(CONFIG_SOC_AMD_COMMON_BLOCK_NONCAR),y) bootblock-y += early_cache.c bootblock-y += pre_c.S bootblock-y += write_resume_eip.c +bootblock-$(CONFIG_TPM_MEASURED_BOOT) += bootblock_measure.c romstage-y += memmap.c ramstage-y += cpu.c romstage-y += cpu.c diff --git a/src/soc/amd/common/block/cpu/noncar/bootblock_measure.c b/src/soc/amd/common/block/cpu/noncar/bootblock_measure.c new file mode 100644 index 0000000000..16ba154bb7 --- /dev/null +++ b/src/soc/amd/common/block/cpu/noncar/bootblock_measure.c @@ -0,0 +1,8 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later */ + +#include + +int tspi_soc_measure_bootblock(int pcr_index) +{ + return 1; +} -- cgit v1.2.3