Change f849972 (security/vboot: Enable TCPA log extension) enabled
support for adding TCPA log to CBMEM. However, if CBMEM is not online,
this function doesn't do anything and returns early. This condition is
not really a valid error condition as it depends on when the call to
tcpa_log_add_table_entry is made. Since tcpa_log_add_table_entry
returns -1 when cbmem is not online, tpm_extend_pcr prints an error
message with prefix "ERROR:". This can confuse any scripts trying to
catch errors in boot flow.
This CL makes the following changes:
1. Removes the print in tpm_extend_pcr since tcpa_log_add_table_entry
already prints out appropriate ERROR messages in case of failure to
add log entry.
2. Since the return value of tcpa_log_add_table_entry is not used
anymore, return type for tcpa_log_add_table_entry is changed to void.
BUG=b:112030232
Change-Id: I32d313609a3e57845e67059b3747b81b5c8adb2a
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://review.coreboot.org/27757
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
Reviewed-by: Justin TerAvest <teravest@chromium.org>
* Move vboot/tpm specific implementation to vboot.
* Only call functions if CONFIG_FSP2_0_USES_TPM_MRC_HASH is set.
* Preparation for software hash function support, no logic changed.
Change-Id: I41a458186c7981adaf3fea8974adec2ca8668f14
Signed-off-by: Philipp Deppenwiese <zaolin@das-labor.org>
Reviewed-on: https://review.coreboot.org/24904
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
These two files were added before I was able to get the updated linter
committed. Updated/Add the headers so the stable header lint check
can be updated.
Change-Id: I464ddecb5eebe8c5b907f3dcfeab1b06501af6ab
Signed-off-by: Martin Roth <martinroth@google.com>
Reviewed-on: https://review.coreboot.org/27362
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Werner Zeh <werner.zeh@siemens.com>
Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net>
Fix a linking problem with VBOOT and USE_OPTION_TABLE enabled.
Make use of cbfs_locate_file_in_region() and always search the
cmos_layout.bin in the 'COREBOOT' region.
With this change applied there's no need to include the vboot_locator
in SMM any more, we can't break NVRAM with different CMOS layouts,
and we keep VBOOT and non VBOOT behaviour the same.
Only include cmos_layout.bin and cmos.default in RO region.
Add notes explaining the decisions.
Tested on Intel Sandybridge, builds and boots with vboot enabled.
Change-Id: I10ae94d7936581bbb5ea49384122062bd4934ea5
Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com>
Reviewed-on: https://review.coreboot.org/26863
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
All those symbols are part of /include/symbols.h file hence
removing from /security/vboot/symbols.h
Change-Id: Id968186e28d6b772a1a6bca200a852407324d6e3
Signed-off-by: Subrata Banik <subrata.banik@intel.com>
Reviewed-on: https://review.coreboot.org/26274
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Patrick Georgi <pgeorgi@google.com>
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
Reviewed-by: Furquan Shaikh <furquan@google.com>
coreboot on skylake originally did ship with romcc bootblock and
verstage running after it. However, that configuration makes boot
flows very complicated. No platform in the current code base uses
this combination. Make VBOOT_STARTS_IN_BOOTBLOCK depend on
C_ENVIRONMENT_BOOTBLOCK.
BUG=b:78656686
Change-Id: Ia9446f209521f71c91b83d579b9e2d89744292bc
Signed-off-by: Aaron Durbin <adurbin@chromium.org>
Reviewed-on: https://review.coreboot.org/25984
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Furquan Shaikh <furquan@google.com>
Reviewed-by: Subrata Banik <subrata.banik@intel.com>
Reviewed-by: Justin TerAvest <teravest@chromium.org>
Reviewed-by: Hannah Williams <hannah.williams@intel.com>
Add a function that will check the various requirements to
enable USB Device Controller (UDC):
- developer mode enabled
- GBB flag set or VBNV flag set
If VBOOT is not enabled, then default is to allow UDC enabling.
BUG=b:78577893
BRANCH=poppy
Change-Id: Id146ac1065f209865372aeb423f66ae734702954
Signed-off-by: Duncan Laurie <dlaurie@google.com>
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://review.coreboot.org/25847
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
This change adds basic support for reading flags from GBB header
located in "GBB" section on SPI flash.
Change-Id: I35ecb5ba964511379baa4e9f458ba2e8c6b74b4e
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://review.coreboot.org/25459
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
This patch changes the GBB flag configuration to the latest usage in
upstream vboot (as of https://chromium-review.googlesource.com/976660).
Change-Id: I585d662d7de34b4964d028e3d06b4df5665fbe9e
Signed-off-by: Julius Werner <jwerner@chromium.org>
Reviewed-on: https://review.coreboot.org/25346
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
In TPM 2.0 case, if the factory initialization is interrupted after
defining, say, the kernel tpm nvram space but before writing to this
space, the following will happen upon reboot when the factory
initialization will be re-attempted. Writing to this space will be
skipped, and coreboot will finish the factory initialization with
this space remained unwritten. At a later stage, when the rollback
logic will attempt to check the version in the kernel space, it will
fail (TPM2.0 returns an error when reading from unwritten spaces),
and the system will go into recovery with no way out (since the
kernel space will never be written).
This change fixes that by always writing to the kernel, MRC hash and
firmware spaces during factory initialization, even if the space
already existed by that time.
BUG=b:71884828
TEST=delete, define, but not write to the kernel space; trigger
factory initialization; coreboot should fill the kernel
space and continue booting.
Change-Id: I48d8bb4f9fc0e5276e6ec81247b3b6768ec9fa3b
Signed-off-by: Andrey Pronin <apronin@google.com>
Reviewed-on: https://review.coreboot.org/23456
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Julius Werner <jwerner@chromium.org>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
* Move code from src/lib and src/include into src/security/tpm
* Split TPM TSS 1.2 and 2.0
* Fix header includes
* Add a new directory structure with kconfig and makefile includes
Change-Id: Id15a9aa6bd367560318dfcfd450bf5626ea0ec2b
Signed-off-by: Philipp Deppenwiese <zaolin@das-labor.org>
Reviewed-on: https://review.coreboot.org/22103
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Stefan Reinauer <stefan.reinauer@coreboot.org>
In order to make VBOOT2 independent from the CHROMEOS
kconfig option a weak method for get_write_protect_state
and get_recovery_mode_switch() is required.
Introduce a kconfig option for controlling this
behaviour.
This is a temporary fix and will be removed afterwards.
Change-Id: I3b1555bd93e1605e04d5c3ea6a752eb1459e426e
Signed-off-by: Philipp Deppenwiese <zaolin@das-labor.org>
Reviewed-on: https://review.coreboot.org/22102
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Martin Roth <martinroth@google.com>
This include is not needed, and the header file is going away in
vboot_reference. So, remove it.
BUG=chromium:789276
BRANCH=none
TEST=emerge-reef coreboot
Change-Id: Ie0b37ae3d2f979f79060a15ca3f7157f49c89785
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Signed-off-by: Randall Spangler <randall@spanglers.com>
Reviewed-on: https://review.coreboot.org/22733
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Julius Werner <jwerner@chromium.org>
Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net>
Reviewed-by: Stefan Reinauer <stefan.reinauer@coreboot.org>
This commit just moves the vboot sources into
the security directory and fixes kconfig/makefile paths.
Fix vboot2 headers
Change-Id: Icd87f95640186f7a625242a3937e1dd13347eb60
Signed-off-by: Philipp Deppenwiese <zaolin@das-labor.org>
Reviewed-on: https://review.coreboot.org/22074
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Martin Roth <martinroth@google.com>
Furquan Shaikh