Start using the vb2 public key format and process the signature
verification using the vb2 routines. This allows us to use the
futility to prepare the keys and eliminates the need for custom
tools.
BUG=N/A
TEST=tested on fbg1701 board
Change-Id: Id5d28595bbfb1f5ca5bca0fcfb06134bb1143f25
Signed-off-by: Wim Vervoorn <wvervoorn@eltan.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/36480
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Frans Hendriks <fhendriks@eltan.com>
On ChromeOS, there will be VPD values for dynamic speaker management (DSM)
calibration data. They are resistor calibration values and temperature
during calibration.
These VPD fields use "dsm_calib_" prefix.
Known keys are:
"dsm_calib_r0_0"
"dsm_calib_r0_1"
"dsm_calib_r0_2"
"dsm_calib_r0_3"
"dsm_calib_temp_0"
For now these values are unsigned decimal numbers greater than 0.
This library will be used for RT1011 device driver in the patch series.
Note that in the future we may encode more values into this VPD field if
needed. We retain the flexibility for coreboot device driver or codec
driver to decode/parse the VPD values based on the needed use case
per-board.
BUG=b:140397934
BRANCH=none
TEST=On Helios, with patch series, check realtek,r0_calib and
realtek,temperature_calib are available to rt1011 codec driver.
Signed-off-by: Cheng-Yi Chiang <cychiang@chromium.org>
Change-Id: Ib9579a5cc055f8f438cb30a8acaf250a343db19e
Reviewed-on: https://review.coreboot.org/c/coreboot/+/36028
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Paul Fagerburg <pfagerburg@chromium.org>
Reviewed-by: Furquan Shaikh <furquan@google.com>
Evaluated using 32-bit arithmetic, then used in a context that
expects an expression of type UINT64. Cast to UINT64 instead.
Change-Id: I4f0aa26e116b47505633897c790ca8e86ea5dc4e
Signed-off-by: Joe Moore <awokd@danwin1210.me>
Found-by: Coverity CID 1241847
Reviewed-on: https://review.coreboot.org/c/coreboot/+/36081
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Patrick Georgi <pgeorgi@google.com>
Code sets `Status = TRUE` in section of code that can only be
reached if `Status == TRUE`.
Change-Id: Id9a49476d17a5ca141994b0d5dfc5e5c62a00f0e
Signed-off-by: Joe Moore <awokd@danwin1210.me>
Found-by: Coverity CID 1241801
Reviewed-on: https://review.coreboot.org/c/coreboot/+/36189
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Kyösti Mälkki <kyosti.malkki@gmail.com>
The vendorcode/eltan mboot and verified boot options only build if a
few other Kconfig options are defined.
Change-Id: Ie333d2fbf294e23ec01df06ee551e2d09541c744
Signed-off-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/35954
Reviewed-by: Wim Vervoorn
Reviewed-by: Michał Żygowski <michal.zygowski@3mdeb.com>
Reviewed-by: Frans Hendriks <fhendriks@eltan.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
There is only one subdir in vendorcode/siemens and it does not feature
a Kconfig file.
Change-Id: I136743344465cea9c769234aa84d9ebe874ef0d2
Signed-off-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/35953
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Werner Zeh <werner.zeh@siemens.com>
Create verified boot support, which includes verifiication of bootblock.
This feature use the vendorcode/eltan/security/lib.
cbfs_locator is used to init the verified boot support.
vendor_secure_prepare() and vendor_secure_locate() are used to preform the
required action in each stage.
The next lists will be used for verification:
* bootblock_verify_list
* postcar_verify_list
* romstage_verify_list
* ramstage_verify_list
BUG=N/A
TEST=Created binary and verify logging on Facebook FBG-1701
Change-Id: If6c1423b0b4a309cefb7fe7a29d5100ba289e0b4
Signed-off-by: Frans Hendriks <fhendriks@eltan.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/30835
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Lance Zhao <lance.zhao@gmail.com>
Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
Create measured boot.
This feature uses the vendorcode/eltan/security/lib.
Measure boot can work with and without Verified boot enabled.
The function mb_measure() is starting point for the support. This
function will be called by the common Verified boot code.
BUG=N/A
TEST=Created binary and verify logging on Facebook FBG-1701
Change-Id: I7f880a17e240515dd42d57383b5ddddf576985b0
Signed-off-by: Frans Hendriks <fhendriks@eltan.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/30833
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net>
Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
cb_sha.c depends on C_ENVIRONMENT_BOOTBLOCK.
Include cb_sha.c unconditional since C_ENVIRONMENT_BOOTBLOCK is default for
chipsets.
BUG=N/A
TEST=Boot Linux 4.20 and verify logging on Facebook FBG-1701
Change-Id: If93195596efe7d8f298430e67eb1cf79804b96fc
Signed-off-by: Frans Hendriks <fhendriks@eltan.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/34667
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Lance Zhao <lance.zhao@gmail.com>
After ChromiumOS CL:1293132 and CL:1295890, Chrome EC can store the flag
telling if the last reboot was triggered by AP watchdog for some boards
(e.g., Kukui).
This CL adds a new function google_chromeec_get_ap_watchdog_flag(),
which reads the AP watchdog flag from Chrome EC, and updates the tables
of reset causes and reset flags.
A new Kconfig option CHROMEOS_USE_EC_WATCHDOG_FLAG is added for
elog_handle_watchdog_tombstone() to determine if watchdog reset was
triggered by the AP watchdog flag from EC instead of the tombstone in
AP.
BUG=b:109900671,b:118654976
BRANCH=none
TEST=test with https://review.coreboot.org/c/coreboot/+/31843
Change-Id: I7a970666a8c6da32ac1c6af8280e808fe7fc106d
Signed-off-by: You-Cheng Syu <youcheng@google.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/31834
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Hung-Te Lin <hungte@chromium.org>
C strict aliasing rules state that it is undefined behaviour to access
any pointer using another pointer of a different type (with several small
exceptions). Eg.
uint64_t x = 3;
uint16_t y = *((uint16_t *)&x); // undefined behaviour
From an architectural point of view there is often nothing wrong with
pointer aliasing - the problem is that since it is undefined behaviour,
the compiler will often use this as a cop-out to perform unintended or
unsafe optimizations. The "safe" way to perfom the above assignment is
to cast the pointers to a uint8_t * first (which is allowed to alias
anything), and then work on a byte level:
*((uint8_t *)&y) = *((uint8_t *)&x);
*((uint8_t *)&y + 1) = *((uint8_t *)&x + 1);
Horribly ugly, but there you go. Anyway, in an attempt to follow these
strict aliasing rules, the ReadMEM() function in SB800 does the above
operation when reading a uint16_t. While perfectly fine, however, it
doesn't have to - all calls to ReadMEM() that read a uint16_t are passed
a uint16_t pointer, so there are no strict aliasing violations to worry
about (the WriteMEM() function is exactly similar). The problem is that
using this unnecessary workaround generates almost 50 false positive
warnings in Coverity. Rather than manually ignore them one-by-one, let's
just remove the workaround entirely. As a side note, this change makes
ReadMEM() and WriteMEM() now match their definitions in the SB900 code.
Change-Id: Ia7e3a1eff88b855a05b33c7dafba16ed23784e43
Signed-off-by: Jacob Garber <jgarber1@ualberta.ca>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/34783
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Patrick Georgi <pgeorgi@google.com>
Variable length arrays were a feature added in C99 that allows the
length of an array to be determined at runtime. Eg.
int sum(size_t n) {
int arr[n];
...
}
This adds a small amount of runtime overhead, but is also very
dangerous, since it allows use of an unlimited amount of stack memory,
potentially leading to stack overflow. This is only worsened in
coreboot, which often has very little stack space to begin with. Citing
concerns like this, all instances of VLA's were recently removed from the
Linux kernel. In the immortal words of Linus Torvalds [0],
AND USING VLA'S IS ACTIVELY STUPID! It generates much more code, and
much _slower_ code (and more fragile code), than just using a fixed
key size would have done. [...] Anyway, some of these are definitely
easy to just fix, and using VLA's is actively bad not just for
security worries, but simply because VLA's are a really horribly bad
idea in general in the kernel.
This patch follows suit and zaps all VLA's in coreboot. Some of the
existing VLA's are accidental ones, and all but one can be replaced with
small fixed-size buffers. The single tricky exception is in the SPI
controller interface, which will require a rewrite of old drivers
to remove [1].
[0] https://lkml.org/lkml/2018/3/7/621
[1] https://ticket.coreboot.org/issues/217
Change-Id: I7d9d1ddadbf1cee5f695165bbe3f0effb7bd32b9
Signed-off-by: Jacob Garber <jgarber1@ualberta.ca>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/33821
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Patrick Georgi <pgeorgi@google.com>
Build error on missing vb2ex_printf() in bootblock stage
Add the file vboot_logic.c which contains the missing vb2ex_printf().
BUG=N/A
TEST=Boot Linux 4.20 and verify logging on Facebook FBG-1701
Change-Id: I3f649f3faf1e812d592e4981bc75698e2cad1cc8
Signed-off-by: Frans Hendriks <fhendriks@eltan.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/34666
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Lance Zhao <lance.zhao@gmail.com>
The <inttypes.h> header currently does nothing but include the
definitions from <stdint.h>, so let's #include that directly instead.
Change-Id: I9d83ad37d0d7300a093001596ce3f0b3830c5701
Signed-off-by: Jacob Garber <jgarber1@ualberta.ca>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/34800
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Nico Huber <nico.h@gmx.de>
To avoid confusion use VENDORCODE_ELTAN_VBOOT and
VENDORCODE_ELTAN_MBOOT config values.
Include verfied_boot and mboot subdirectories as CPPFLAGS when
measured boot or verified boot is enabled. This allows to generate
binary with measured boot enabled only.
BUG=N/A
TEST=Boot Linux 4.20 and verify logging on Facebook FBG-1701
Change-Id: Iaaf3c8cacbc8d2be7387264ca9c973e583871f0a
Signed-off-by: Frans Hendriks <fhendriks@eltan.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/33442
Reviewed-by: Lance Zhao <lance.zhao@gmail.com>
Reviewed-by: Martin Roth <martinroth@google.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
This function can capture and allocate its own eye data, so in that case
set need_free to true so it is freed at the end.
Change-Id: I63ca6d743e6610d3e3ab6bd7b0356aabdfa6f784
Signed-off-by: Jacob Garber <jgarber1@ualberta.ca>
Found-by: Coverity CID 1393969
Reviewed-on: https://review.coreboot.org/c/coreboot/+/34591
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Patrick Rudolph <siro@das-labor.org>
The bdk_phys_to_ptr() function converts a uint64_t address to a void *
pointer. Judging by the comments, the old implementation had a check
that would refuse to convert a null pointer, which required several
workarounds when trying to convert the address 0 to a pointer. This
isn't the case for coreboot though, which implements this function
as a simple (void *) cast, so we can remove the old workarounds.
Change-Id: I6537d1699e6726c1fb155d69a51e14da856232de
Signed-off-by: Jacob Garber <jgarber1@ualberta.ca>
Found-by: Coverity CID 1393962
Reviewed-on: https://review.coreboot.org/c/coreboot/+/34590
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Patrick Rudolph <siro@das-labor.org>
Ensure that best_en_idx is within bounds before accessing the _en array.
Change-Id: Ifa6259e28875a8cf8199896bda7982370ccaa277
Signed-off-by: Jacob Garber <jgarber1@ualberta.ca>
Found-by: Coverity CID 1393971
Reviewed-on: https://review.coreboot.org/c/coreboot/+/34593
Reviewed-by: Patrick Rudolph <siro@das-labor.org>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
The total number of errors is only needed after a final tuning run at the
end of this function, so we can remove this unneeded store for earlier
runs.
Change-Id: I62adb38ccba98d90bcf8ccd13998762b9b694111
Signed-off-by: Jacob Garber <jgarber1@ualberta.ca>
Found-by: Coverity CID 1393967
Reviewed-on: https://review.coreboot.org/c/coreboot/+/34592
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Patrick Rudolph <siro@das-labor.org>
volt_str is used to print information about the RAM configuration
in report_common_dimm(), so let's print out "unknown voltage" if the
voltage isn't recognized rather than a garbage value.
Change-Id: I8e85917fd682e166172fbf10597bde4a8a11dfc7
Signed-off-by: Jacob Garber <jgarber1@ualberta.ca>
Found-by: Coverity CID 1393958, 1393982
Reviewed-on: https://review.coreboot.org/c/coreboot/+/34576
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Patrick Rudolph <siro@das-labor.org>
Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net>
Implicit fall throughs are a perpetual source of bugs and Coverity Scan
issues, so let's squash them once and for all. GCC can flag implicit fall
throughs using the -Wimplicit-fallthrough warning, and this should
ensure no more enter the code base. However, many fall throughs are
intentional, and we can use the following comment style to have GCC
suppress the warning.
switch (x) {
case 1:
y += 1;
/* fall through */
case 2:
y += 2;
/* fall through - but this time with an explanation */
default:
y += 3;
}
This patch adds comments for all remaining intentional fall throughs,
and tweaks some existing fall through comments to fit the syntax that
GCC expects.
Change-Id: I1d75637a434a955a58d166ad203e49620d7395ed
Signed-off-by: Jacob Garber <jgarber1@ualberta.ca>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/34297
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: HAOUAS Elyes <ehaouas@noos.fr>
Add changes needed to build a project using Merlin Falcon SOC using 00670F00
vendor code, which is backward compatible with Merlin Falcon. Only the AGESA
binary image is different then the one used by 00670F00.
BUG=none.
TEST=Tested later with padmelon board.
Change-Id: Id3341f6a1ef2561a6391d3db8c54f6bdd09b0c0e
Signed-off-by: Richard Spiegel <richard.spiegel@silverbackltd.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/33622
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Martin Roth <martinroth@google.com>
digest from vb2_digest_bufer() does not contains the correct endian.
Create cb_sha_endian() which can convert the calculated digest into big endian
or little endian when required.
BUG=N/A
TEST=Created binary and verify logging on Facebok FBG-1701
Change-Id: If828bde54c79e836a5b05ff0447645d7e06e819a
Signed-off-by: Frans Hendriks <fhendriks@eltan.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/30831
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
Sometimes coreboot needs to compile external code (e.g.
vboot_reference) using its own set of system header files. When
these headers don't line up with C Standard Library, it causes
problems.
Create ctype.h header file. Relocate ctype.h functions from
string.h into ctype.h. Update source files which call ctype.h
functions accordingly.
Note that ctype.h still lacks five functions which are not used
in coreboot source:
isalnum, isalpha, iscntrl, isgraph, ispunct
BUG=b:124141368
TEST=make clean && make test-abuild
BRANCH=none
Change-Id: I31b5e8af49956ec024a392a73c3c9024b9a9c194
Signed-off-by: Joel Kitching <kitching@google.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/33525
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Julius Werner <jwerner@chromium.org>
"if (_pcidata != 0xFFFFFFFF || _pcidata != 0)", is always true.
The right test should be && not ||.
Error found using -Wlogical-op warning option.
Change-Id: I537fa4867499e1e6e5f662086fabc99b91aa0c70
Signed-off-by: Elyes HAOUAS <ehaouas@noos.fr>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/33392
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Martin Roth <martinroth@google.com>
This patch contains the general files for the vendorcode/eltan that has
been uploaded recently:
- Add eltan directory to vendorcode.
- Add documentation about the support in the vendorcode directories.
- Add the Makefile.inc and Kconfig for the vendorcode/eltan and
vendorcode/eltan/security.
BUG=N/A
TEST=Created verified binary and verify logging on Portwell PQ-M107
Change-Id: Ic1d5a21d40b6a31886777e8e9fe7b28c860f1a80
Signed-off-by: Frans Hendriks <fhendriks@eltan.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/30218
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
<types.h> is supposed to provide <stdint.h> and <stddef.h>.
So when <types.h> is included, <stdint.h> and/or <stddef.h> is removed.
Change-Id: I1eb4163fb36a47b584f1fc9dd3c012e2930e9866
Signed-off-by: Elyes HAOUAS <ehaouas@noos.fr>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/32807
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Lijian Zhao <lijian.zhao@intel.com>
The call to timestamp_rescale_table() had to be moved
before TS_AGESA_INIT_{POST/RESUME}_DONE to have that
timestamp appear without rescaling.
Change-Id: I71e09d3bc4c8657979d447b90fb6ac7cae959479
Signed-off-by: Kyösti Mälkki <kyosti.malkki@gmail.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/31515
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Patrick Georgi <pgeorgi@google.com>
Place it within class libagesa to avoid including
AGESA internal header heapManager.h in coreboot
proper build CPPFLAGS.
Change-Id: Iae86d6631d7a6ba6ea2588a53b292b435dfd7861
Signed-off-by: Kyösti Mälkki <kyosti.malkki@gmail.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/31511
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Patrick Georgi <pgeorgi@google.com>
While not implemented, copying the definitions from
later AGESA/AMD.h to older helps us avoid lots of
preprocessor directives.
Change-Id: I34edc1ca23e9c063c4286273c53249ff0a953798
Signed-off-by: Kyösti Mälkki <kyosti.malkki@gmail.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/31510
Reviewed-by: Marshall Dawson <marshalldawson3rd@gmail.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
AmdCreateStruct() and AmdReleaseStruct() are equally bad
when it comes to lack of correct function declarations
for definitions found in vendorcode binaryPI/AGESA.c.
Replace these with calls that go through the common
module_dispatch() functions.
Change-Id: I611bcbe2a71fb65c8eb759a9dc74cbd9cb74136e
Signed-off-by: Kyösti Mälkki <kyosti.malkki@gmail.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/31486
Reviewed-by: Richard Spiegel <richard.spiegel@silverbackltd.com>
Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
This microcode update for CPU IDs 0x610F01/0x610F31 improves system stability:
in particular, fixes Xen hardware virtualization freezes. Also it attempts to
patch some Spectre-related security vulnerabilities. This new microcode has been
tested by multiple coreboot community members and found working perfectly.
Old version: 0x600110F [2012-01-11]
replaced by
New version: 0x600111F [2018-03-05]
Change-Id: Ied5da0ff85abb63c2db2eeafd051b8e00916d961
Signed-off-by: Mike Banon <mikebdp2@gmail.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/28273
Reviewed-by: Martin Roth <martinroth@google.com>
Reviewed-by: <awokd@danwin1210.me>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
