Commit Graph

16 Commits

Author SHA1 Message Date
Angel Pons 5c186c6777 Documentation/releases: Update for 4.13
Fill in some blanks for 4.13, mark it done, add template for 4.14.
Also update the list of vboot supported boards.

Change-Id: Ie593efe515136a3b06620db6f0dbe3da00df7e9b
Signed-off-by: Angel Pons <th3fanbus@gmail.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/47801
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Arthur Heymans <arthur@aheymans.xyz>
2020-11-20 12:01:35 +00:00
Julius Werner 9c50462fd7 Delete mainboard/google/cheza
Work on this mainboard was abandoned and never finished. It's not really
usable in its current state, so let's get rid of it.

Signed-off-by: Julius Werner <jwerner@chromium.org>
Change-Id: I4cd2e2cd0ee69d9846472653a942fa074e2b924d
Reviewed-on: https://review.coreboot.org/c/coreboot/+/47427
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Stefan Reinauer <stefan.reinauer@coreboot.org>
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2020-11-12 01:43:09 +00:00
Bob Moragues c06c0ce559 strongbad / coachz : Add Initial Support
BUG=b:162409909
BUG=b:164196066
BRANCH=NONE
TEST=Verify build of strongbad target

Signed-off-by: Bob Moragues <moragues@chromium.org>
Change-Id: If83bd2c8f25fdd3c9625f40121e55c3c922a66fe
Reviewed-on: https://review.coreboot.org/c/coreboot/+/45276
Reviewed-by: Julius Werner <jwerner@chromium.org>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2020-09-11 22:32:34 +00:00
Patrick Rudolph 41fec869fb cpu/x86/smm: Add helper functions to verify SMM access
* Add a function to check if a region overlaps with SMM.
* Add a function to check if a pointer points to SMM.
* Document functions in Documentation/security/smm

To be used to verify data accesses in SMM.

Change-Id: Ia525d2bc685377f50ecf3bdcf337a4c885488213
Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com>
Signed-off-by: Christian Walter <christian.walter@9elements.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/41084
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
Reviewed-by: Patrick Georgi <pgeorgi@google.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2020-06-17 09:17:56 +00:00
Patrick Georgi f2c32515ee Documentation/releases: Update for 4.12
Fill in some blanks for 4.12, mark it done, add template for 4.13.
Also update the list of vboot supported boards.

Change-Id: Id6b663f13367eb40e66af30aadd33991c8dd635c
Signed-off-by: Patrick Georgi <patrick@georgi.software>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/41259
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: HAOUAS Elyes <ehaouas@noos.fr>
Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net>
2020-05-12 10:30:22 +00:00
Patrick Rudolph 8c82010c97 Documentation: Spell vboot all lowercase
Update all occurrences of vboot and spell it lowercase.

Change-Id: I432b0db8a3dda43b71844e557a3d89180f25f1c3
Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com>
Signed-off-by: Marcello Sylvester Bauer <sylv@sylv.io>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/39799
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Patrick Georgi <pgeorgi@google.com>
2020-04-28 06:14:25 +00:00
Arthur Heymans 895c77f361 Documentation/vboot: Drop deprecated options from example
4K keys are now default.

Change-Id: I16599d0e8b874f9e8a56100fea06d6e4f94a5c00
Signed-off-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/37149
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net>
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2020-04-14 10:04:10 +00:00
Marcello Sylvester Bauer e9aef1fe45 Doc/security/vboot: Add a script generated device list
Add a script generated list of vboot enabled devices to the
documentation. Add a entry to the release checklist.

Change-Id: Ibb57d26c5f0cb8efd27ca9a97fd762c25b566f93
Signed-off-by: Marcello Sylvester Bauer <sylv@sylv.io>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/39200
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Patrick Rudolph <patrick.rudolph@9elements.com>
Reviewed-by: Patrick Georgi <pgeorgi@google.com>
2020-03-23 09:23:11 +00:00
Wim Vervoorn 114e2e8830 lib/cbfs: Add fallback to RO region to cbfs_boot_locate
With this change cbfs_boot_locate will check the RO (COREBOOT) region if
a file can not be found in the active RW region. By doing so it is not
required to duplicate static files that are not intended to be updated
to the RW regions.

The coreboot image can still be updated by adding the file to the RW
region.

This change is intended to support VBOOT on systems with a small flash
device.

BUG=N/A
TEST=tested on facebook fbg1701

Change-Id: I81ceaf927280cef9a3f09621c796c451e9115211
Signed-off-by: Wim Vervoorn <wvervoorn@eltan.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/36545
Reviewed-by: Frans Hendriks <fhendriks@eltan.com>
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2019-11-07 14:12:00 +00:00
Patrick Rudolph 5fffb5e30d security/intel: Add TXT infrastructure
* Add Kconfig to enable TXT
* Add possibility to add BIOS and SINIT ACMs
* Set default BIOS ACM alignment
* Increase FIT space if TXT is enabled

The following commits depend on the basic Kconfig infrastructure.
Intel TXT isn't supported until all following commits are merged.

Change-Id: I5f0f956d2b7ba43d4e7e0062803c6d8ba569a052
Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/34585
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: David Hendricks <david.hendricks@gmail.com>
2019-09-02 04:52:04 +00:00
Patrick Rudolph fa0ef81d15 Documentation: Add Intel TXT
Change-Id: I9e9606d0e4294ad3552ec3b3b44629f9e732d82b
Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/33416
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Subrata Banik <subrata.banik@intel.com>
2019-07-19 12:19:19 +00:00
Patrick Rudolph c1b7e8a60b cpu/x86/pae/pgtbl: Add memset with PAE
To clear all DRAM on x86_32, add a new method that uses PAE to access
more than 32bit of address space.
Add Documentation as well.

Required for clearing all system memory as part of security API.

Tested on wedge100s:
 Takes less than 2 seconds to clear 8GiB of DRAM.
Tested on P8H61M-Pro:
 Takes less than 1 second to clear 4GiB of DRAM.

Change-Id: I00f7ecf87b5c9227a9d58a0b61eecc38007e1a57
Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/31549
Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2019-07-02 08:45:50 +00:00
Patrick Rudolph 1b35295ec2 security: Add memory subfolder
Add files to introduce a memory clearing framework.
Introduce Kconfig PLATFORM_HAS_DRAM_CLEAR that is to be selected by
platforms, that are able to clear all DRAM.

Introduce Kconfig SECURITY_CLEAR_DRAM_ON_REGULAR_BOOT that is user
selectable to always clear DRAM on non S3 boot.

The function security_clear_dram_request tells the calling platform when
to wipe all DRAM. Will be extended by TEE frameworks.

Add Documentation for the new security API.

Change-Id: Ifba25bfdd1057049f5cbae8968501bd9be487110
Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/31548
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
Reviewed-by: Christian Walter <christian.walter@9elements.com>
2019-06-27 10:02:04 +00:00
Patrick Rudolph fe80bf2fd1 Documentation: Convert vboot to markdown
Convert the HTML document to markdown and place it under security section.

Change-Id: I212c6d0c977fd6772371ff6676478d48cc215d6e
Signed-off-by: Patrick Rudolph <siro@das-labor.org>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/32610
Reviewed-by: Patrick Georgi <pgeorgi@google.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2019-05-08 10:33:44 +00:00
Philipp Deppenwiese c9b7d1fb57 security/tpm: Fix TCPA log feature
Until now the TCPA log wasn't working correctly.

* Refactor TCPA log code.
* Add TCPA log dump fucntion.
* Make TCPA log available in bootblock.
* Fix TCPA log formatting.
* Add x86 and Cavium memory for early log.

Change-Id: Ic93133531b84318f48940d34bded48cbae739c44
Signed-off-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/29563
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Patrick Rudolph <siro@das-labor.org>
2019-03-07 12:47:01 +00:00
Philipp Deppenwiese 66f9a09916 security/vboot: Add measured boot mode
* Introduce a measured boot mode into vboot.
* Add hook for stage measurements in prog_loader and cbfs.
* Implement and hook-up CRTM in vboot and check for suspend.

Change-Id: I339a2f1051e44f36aba9f99828f130592a09355e
Signed-off-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
Signed-off-by: Werner Zeh <werner.zeh@siemens.com>
Reviewed-on: https://review.coreboot.org/c/29547
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2019-02-25 22:29:16 +00:00