2020-04-02 23:48:27 +02:00
|
|
|
/* SPDX-License-Identifier: GPL-2.0-only */
|
New mechanism to define SRAM/memory map with automatic bounds checking
This patch creates a new mechanism to define the static memory layout
(primarily in SRAM) for a given board, superseding the brittle mass of
Kconfigs that we were using before. The core part is a memlayout.ld file
in the mainboard directory (although boards are expected to just include
the SoC default in most cases), which is the primary linker script for
all stages (though not rmodules for now). It uses preprocessor macros
from <memlayout.h> to form a different valid linker script for all
stages while looking like a declarative, boilerplate-free map of memory
addresses to the programmer. Linker asserts will automatically guarantee
that the defined regions cannot overlap. Stages are defined with a
maximum size that will be enforced by the linker. The file serves to
both define and document the memory layout, so that the documentation
cannot go missing or out of date.
The mechanism is implemented for all boards in the ARM, ARM64 and MIPS
architectures, and should be extended onto all systems using SRAM in the
future. The CAR/XIP environment on x86 has very different requirements
and the layout is generally not as static, so it will stay like it is
and be unaffected by this patch (save for aligning some symbol names for
consistency and sharing the new common ramstage linker script include).
BUG=None
TEST=Booted normally and in recovery mode, checked suspend/resume and
the CBMEM console on Falco, Blaze (both normal and vboot2), Pinky and
Pit. Compiled Ryu, Storm and Urara, manually compared the disassemblies
with ToT and looked for red flags.
Change-Id: Ifd2276417f2036cbe9c056f17e42f051bcd20e81
Signed-off-by: Patrick Georgi <pgeorgi@chromium.org>
Original-Commit-Id: f1e2028e7ebceeb2d71ff366150a37564595e614
Original-Change-Id: I005506add4e8fcdb74db6d5e6cb2d4cb1bd3cda5
Original-Signed-off-by: Julius Werner <jwerner@chromium.org>
Original-Reviewed-on: https://chromium-review.googlesource.com/213370
Reviewed-on: http://review.coreboot.org/9283
Tested-by: build bot (Jenkins)
Reviewed-by: Stefan Tauner <stefan.tauner@gmx.at>
Reviewed-by: Aaron Durbin <adurbin@google.com>
2014-08-21 00:29:56 +02:00
|
|
|
|
|
|
|
#ifndef __SYMBOLS_H
|
|
|
|
#define __SYMBOLS_H
|
|
|
|
|
|
|
|
#include <types.h>
|
|
|
|
|
|
|
|
extern u8 _dram[];
|
|
|
|
|
2020-12-31 00:51:10 +01:00
|
|
|
#define REGION_SIZE(name) ((size_t)_##name##_size)
|
2016-10-19 17:07:13 +02:00
|
|
|
|
2019-02-21 03:39:22 +01:00
|
|
|
#define DECLARE_REGION(name) \
|
|
|
|
extern u8 _##name[]; \
|
2020-12-31 00:51:10 +01:00
|
|
|
extern u8 _e##name[]; \
|
|
|
|
extern u8 _##name##_size[];
|
2015-12-17 01:07:39 +01:00
|
|
|
|
2020-08-26 01:00:44 +02:00
|
|
|
/*
|
|
|
|
* Regions can be declared optional if not all configurations provide them in
|
|
|
|
* memlayout and you want code to be able to check for their existence at
|
|
|
|
* runtime. Not every region that is architecture or platform-specific should
|
|
|
|
* use this -- only declare regions optional if the code *accessing* them runs
|
|
|
|
* both on configurations that have the region and those that don't. That code
|
|
|
|
* should then check (REGION_SIZE(name) != 0) before accessing it.
|
|
|
|
*/
|
|
|
|
#define DECLARE_OPTIONAL_REGION(name) \
|
|
|
|
__weak extern u8 _##name[]; \
|
2020-12-31 00:51:10 +01:00
|
|
|
__weak extern u8 _e##name[]; \
|
|
|
|
__weak extern u8 _##name##_size[];
|
2020-08-26 01:00:44 +02:00
|
|
|
|
2019-02-21 03:39:22 +01:00
|
|
|
DECLARE_REGION(sram)
|
2020-08-26 01:00:44 +02:00
|
|
|
DECLARE_OPTIONAL_REGION(timestamp)
|
2019-02-21 03:39:22 +01:00
|
|
|
DECLARE_REGION(preram_cbmem_console)
|
|
|
|
DECLARE_REGION(cbmem_init_hooks)
|
|
|
|
DECLARE_REGION(stack)
|
2020-12-31 02:30:12 +01:00
|
|
|
DECLARE_OPTIONAL_REGION(preram_cbfs_cache)
|
|
|
|
DECLARE_OPTIONAL_REGION(postram_cbfs_cache)
|
|
|
|
DECLARE_OPTIONAL_REGION(cbfs_cache)
|
2019-12-12 02:09:39 +01:00
|
|
|
DECLARE_REGION(cbfs_mcache)
|
2019-11-07 04:29:44 +01:00
|
|
|
DECLARE_REGION(fmap_cache)
|
security/vboot: Decouple measured boot from verified boot
Currently, those who want to use measured boot implemented within
vboot should enable verified boot first, along with sections such
as GBB and RW slots defined with manually written fmd files, even
if they do not actually want to verify anything.
As discussed in CB:34977, measured boot should be decoupled from
verified boot and make them two fully independent options. Crypto
routines necessary for measurement could be reused, and TPM and CRTM
init should be done somewhere other than vboot_logic_executed() if
verified boot is not enabled.
In this revision, only TCPA log is initialized during bootblock.
Before TPM gets set up, digests are not measured into tpm immediately,
but cached in TCPA log, and measured into determined PCRs right after
TPM is up.
This change allows those who do not want to use the verified boot
scheme implemented by vboot as well as its requirement of a more
complex partition scheme designed for chromeos to make use of the
measured boot functionality implemented within vboot library to
measure the boot process.
TODO: Measure MRC Cache somewhere, as MRC Cache has never resided in
CBFS any more, so it cannot be covered by tspi_measure_cbfs_hook().
Change-Id: I1fb376b4a8b98baffaee4d574937797bba1f8aee
Signed-off-by: Bill XIE <persmule@hardenedlinux.org>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/35077
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
Reviewed-by: Julius Werner <jwerner@chromium.org>
Reviewed-by: Werner Zeh <werner.zeh@siemens.com>
2019-08-22 14:28:36 +02:00
|
|
|
DECLARE_REGION(tpm_tcpa_log)
|
|
|
|
|
2020-07-20 09:21:05 +02:00
|
|
|
#if ENV_ROMSTAGE && CONFIG(ASAN_IN_ROMSTAGE)
|
|
|
|
DECLARE_REGION(bss)
|
|
|
|
DECLARE_REGION(asan_shadow)
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#if ENV_RAMSTAGE && CONFIG(ASAN_IN_RAMSTAGE)
|
2020-06-18 05:19:00 +02:00
|
|
|
DECLARE_REGION(data)
|
|
|
|
DECLARE_REGION(heap)
|
|
|
|
DECLARE_REGION(asan_shadow)
|
|
|
|
#endif
|
|
|
|
|
security/vboot: Decouple measured boot from verified boot
Currently, those who want to use measured boot implemented within
vboot should enable verified boot first, along with sections such
as GBB and RW slots defined with manually written fmd files, even
if they do not actually want to verify anything.
As discussed in CB:34977, measured boot should be decoupled from
verified boot and make them two fully independent options. Crypto
routines necessary for measurement could be reused, and TPM and CRTM
init should be done somewhere other than vboot_logic_executed() if
verified boot is not enabled.
In this revision, only TCPA log is initialized during bootblock.
Before TPM gets set up, digests are not measured into tpm immediately,
but cached in TCPA log, and measured into determined PCRs right after
TPM is up.
This change allows those who do not want to use the verified boot
scheme implemented by vboot as well as its requirement of a more
complex partition scheme designed for chromeos to make use of the
measured boot functionality implemented within vboot library to
measure the boot process.
TODO: Measure MRC Cache somewhere, as MRC Cache has never resided in
CBFS any more, so it cannot be covered by tspi_measure_cbfs_hook().
Change-Id: I1fb376b4a8b98baffaee4d574937797bba1f8aee
Signed-off-by: Bill XIE <persmule@hardenedlinux.org>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/35077
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
Reviewed-by: Julius Werner <jwerner@chromium.org>
Reviewed-by: Werner Zeh <werner.zeh@siemens.com>
2019-08-22 14:28:36 +02:00
|
|
|
/* Regions for execution units. */
|
New mechanism to define SRAM/memory map with automatic bounds checking
This patch creates a new mechanism to define the static memory layout
(primarily in SRAM) for a given board, superseding the brittle mass of
Kconfigs that we were using before. The core part is a memlayout.ld file
in the mainboard directory (although boards are expected to just include
the SoC default in most cases), which is the primary linker script for
all stages (though not rmodules for now). It uses preprocessor macros
from <memlayout.h> to form a different valid linker script for all
stages while looking like a declarative, boilerplate-free map of memory
addresses to the programmer. Linker asserts will automatically guarantee
that the defined regions cannot overlap. Stages are defined with a
maximum size that will be enforced by the linker. The file serves to
both define and document the memory layout, so that the documentation
cannot go missing or out of date.
The mechanism is implemented for all boards in the ARM, ARM64 and MIPS
architectures, and should be extended onto all systems using SRAM in the
future. The CAR/XIP environment on x86 has very different requirements
and the layout is generally not as static, so it will stay like it is
and be unaffected by this patch (save for aligning some symbol names for
consistency and sharing the new common ramstage linker script include).
BUG=None
TEST=Booted normally and in recovery mode, checked suspend/resume and
the CBMEM console on Falco, Blaze (both normal and vboot2), Pinky and
Pit. Compiled Ryu, Storm and Urara, manually compared the disassemblies
with ToT and looked for red flags.
Change-Id: Ifd2276417f2036cbe9c056f17e42f051bcd20e81
Signed-off-by: Patrick Georgi <pgeorgi@chromium.org>
Original-Commit-Id: f1e2028e7ebceeb2d71ff366150a37564595e614
Original-Change-Id: I005506add4e8fcdb74db6d5e6cb2d4cb1bd3cda5
Original-Signed-off-by: Julius Werner <jwerner@chromium.org>
Original-Reviewed-on: https://chromium-review.googlesource.com/213370
Reviewed-on: http://review.coreboot.org/9283
Tested-by: build bot (Jenkins)
Reviewed-by: Stefan Tauner <stefan.tauner@gmx.at>
Reviewed-by: Aaron Durbin <adurbin@google.com>
2014-08-21 00:29:56 +02:00
|
|
|
|
security/vboot: Decouple measured boot from verified boot
Currently, those who want to use measured boot implemented within
vboot should enable verified boot first, along with sections such
as GBB and RW slots defined with manually written fmd files, even
if they do not actually want to verify anything.
As discussed in CB:34977, measured boot should be decoupled from
verified boot and make them two fully independent options. Crypto
routines necessary for measurement could be reused, and TPM and CRTM
init should be done somewhere other than vboot_logic_executed() if
verified boot is not enabled.
In this revision, only TCPA log is initialized during bootblock.
Before TPM gets set up, digests are not measured into tpm immediately,
but cached in TCPA log, and measured into determined PCRs right after
TPM is up.
This change allows those who do not want to use the verified boot
scheme implemented by vboot as well as its requirement of a more
complex partition scheme designed for chromeos to make use of the
measured boot functionality implemented within vboot library to
measure the boot process.
TODO: Measure MRC Cache somewhere, as MRC Cache has never resided in
CBFS any more, so it cannot be covered by tspi_measure_cbfs_hook().
Change-Id: I1fb376b4a8b98baffaee4d574937797bba1f8aee
Signed-off-by: Bill XIE <persmule@hardenedlinux.org>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/35077
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
Reviewed-by: Julius Werner <jwerner@chromium.org>
Reviewed-by: Werner Zeh <werner.zeh@siemens.com>
2019-08-22 14:28:36 +02:00
|
|
|
DECLARE_REGION(payload)
|
2015-09-04 05:49:36 +02:00
|
|
|
/* "program" always refers to the current execution unit. */
|
2019-02-21 03:39:22 +01:00
|
|
|
DECLARE_REGION(program)
|
2016-02-19 00:46:15 +01:00
|
|
|
/* _<stage>_size is always the maximum amount allocated in memlayout, whereas
|
2019-02-21 03:39:22 +01:00
|
|
|
_program_size gives the actual memory footprint *used* by current stage. */
|
|
|
|
DECLARE_REGION(decompressor)
|
|
|
|
DECLARE_REGION(bootblock)
|
|
|
|
DECLARE_REGION(verstage)
|
|
|
|
DECLARE_REGION(romstage)
|
|
|
|
DECLARE_REGION(postcar)
|
|
|
|
DECLARE_REGION(ramstage)
|
2016-02-19 00:46:15 +01:00
|
|
|
|
New mechanism to define SRAM/memory map with automatic bounds checking
This patch creates a new mechanism to define the static memory layout
(primarily in SRAM) for a given board, superseding the brittle mass of
Kconfigs that we were using before. The core part is a memlayout.ld file
in the mainboard directory (although boards are expected to just include
the SoC default in most cases), which is the primary linker script for
all stages (though not rmodules for now). It uses preprocessor macros
from <memlayout.h> to form a different valid linker script for all
stages while looking like a declarative, boilerplate-free map of memory
addresses to the programmer. Linker asserts will automatically guarantee
that the defined regions cannot overlap. Stages are defined with a
maximum size that will be enforced by the linker. The file serves to
both define and document the memory layout, so that the documentation
cannot go missing or out of date.
The mechanism is implemented for all boards in the ARM, ARM64 and MIPS
architectures, and should be extended onto all systems using SRAM in the
future. The CAR/XIP environment on x86 has very different requirements
and the layout is generally not as static, so it will stay like it is
and be unaffected by this patch (save for aligning some symbol names for
consistency and sharing the new common ramstage linker script include).
BUG=None
TEST=Booted normally and in recovery mode, checked suspend/resume and
the CBMEM console on Falco, Blaze (both normal and vboot2), Pinky and
Pit. Compiled Ryu, Storm and Urara, manually compared the disassemblies
with ToT and looked for red flags.
Change-Id: Ifd2276417f2036cbe9c056f17e42f051bcd20e81
Signed-off-by: Patrick Georgi <pgeorgi@chromium.org>
Original-Commit-Id: f1e2028e7ebceeb2d71ff366150a37564595e614
Original-Change-Id: I005506add4e8fcdb74db6d5e6cb2d4cb1bd3cda5
Original-Signed-off-by: Julius Werner <jwerner@chromium.org>
Original-Reviewed-on: https://chromium-review.googlesource.com/213370
Reviewed-on: http://review.coreboot.org/9283
Tested-by: build bot (Jenkins)
Reviewed-by: Stefan Tauner <stefan.tauner@gmx.at>
Reviewed-by: Aaron Durbin <adurbin@google.com>
2014-08-21 00:29:56 +02:00
|
|
|
/* Arch-specific, move to <arch/symbols.h> if they become too many. */
|
|
|
|
|
2019-02-21 03:39:22 +01:00
|
|
|
DECLARE_REGION(pagetables)
|
|
|
|
DECLARE_REGION(ttb)
|
2020-08-26 01:00:44 +02:00
|
|
|
DECLARE_OPTIONAL_REGION(ttb_subtables)
|
2019-02-21 03:39:22 +01:00
|
|
|
DECLARE_REGION(dma_coherent)
|
|
|
|
DECLARE_REGION(soc_registers)
|
|
|
|
DECLARE_REGION(framebuffer)
|
|
|
|
DECLARE_REGION(pdpt)
|
2020-08-26 01:00:44 +02:00
|
|
|
DECLARE_OPTIONAL_REGION(opensbi)
|
|
|
|
DECLARE_OPTIONAL_REGION(bl31)
|
2020-06-26 16:40:56 +02:00
|
|
|
DECLARE_REGION(transfer_buffer)
|
2015-07-24 15:29:06 +02:00
|
|
|
|
2019-02-11 08:37:49 +01:00
|
|
|
/* Returns true when pre-RAM symbols are known to the linker.
|
|
|
|
* (Does not necessarily mean that the memory is accessible.) */
|
|
|
|
static inline int preram_symbols_available(void)
|
|
|
|
{
|
2020-06-08 05:05:03 +02:00
|
|
|
return !ENV_X86 || ENV_ROMSTAGE_OR_BEFORE;
|
2019-02-11 08:37:49 +01:00
|
|
|
}
|
|
|
|
|
New mechanism to define SRAM/memory map with automatic bounds checking
This patch creates a new mechanism to define the static memory layout
(primarily in SRAM) for a given board, superseding the brittle mass of
Kconfigs that we were using before. The core part is a memlayout.ld file
in the mainboard directory (although boards are expected to just include
the SoC default in most cases), which is the primary linker script for
all stages (though not rmodules for now). It uses preprocessor macros
from <memlayout.h> to form a different valid linker script for all
stages while looking like a declarative, boilerplate-free map of memory
addresses to the programmer. Linker asserts will automatically guarantee
that the defined regions cannot overlap. Stages are defined with a
maximum size that will be enforced by the linker. The file serves to
both define and document the memory layout, so that the documentation
cannot go missing or out of date.
The mechanism is implemented for all boards in the ARM, ARM64 and MIPS
architectures, and should be extended onto all systems using SRAM in the
future. The CAR/XIP environment on x86 has very different requirements
and the layout is generally not as static, so it will stay like it is
and be unaffected by this patch (save for aligning some symbol names for
consistency and sharing the new common ramstage linker script include).
BUG=None
TEST=Booted normally and in recovery mode, checked suspend/resume and
the CBMEM console on Falco, Blaze (both normal and vboot2), Pinky and
Pit. Compiled Ryu, Storm and Urara, manually compared the disassemblies
with ToT and looked for red flags.
Change-Id: Ifd2276417f2036cbe9c056f17e42f051bcd20e81
Signed-off-by: Patrick Georgi <pgeorgi@chromium.org>
Original-Commit-Id: f1e2028e7ebceeb2d71ff366150a37564595e614
Original-Change-Id: I005506add4e8fcdb74db6d5e6cb2d4cb1bd3cda5
Original-Signed-off-by: Julius Werner <jwerner@chromium.org>
Original-Reviewed-on: https://chromium-review.googlesource.com/213370
Reviewed-on: http://review.coreboot.org/9283
Tested-by: build bot (Jenkins)
Reviewed-by: Stefan Tauner <stefan.tauner@gmx.at>
Reviewed-by: Aaron Durbin <adurbin@google.com>
2014-08-21 00:29:56 +02:00
|
|
|
#endif /* __SYMBOLS_H */
|