Go to file
Andrey Pronin 278a5064b4 security/vboot: overwrite existing spaces during factory init for tpm2
In TPM 2.0 case, if the factory initialization is interrupted after
defining, say, the kernel tpm nvram space but before writing to this
space, the following will happen upon reboot when the factory
initialization will be re-attempted. Writing to this space will be
skipped, and coreboot will finish the factory initialization with
this space remained unwritten. At a later stage, when the rollback
logic will attempt to check the version in the kernel space, it will
fail (TPM2.0 returns an error when reading from unwritten spaces),
and the system will go into recovery with no way out (since the
kernel space will never be written).

This change fixes that by always writing to the kernel, MRC hash and
firmware spaces during factory initialization, even if the space
already existed by that time.

BUG=b:71884828
TEST=delete, define, but not write to the kernel space; trigger
     factory initialization; coreboot should fill the kernel
     space and continue booting.

Change-Id: I48d8bb4f9fc0e5276e6ec81247b3b6768ec9fa3b
Signed-off-by: Andrey Pronin <apronin@google.com>
Reviewed-on: https://review.coreboot.org/23456
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Julius Werner <jwerner@chromium.org>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
2018-02-07 02:37:25 +00:00
3rdparty Update blobs submodule to upstream master 2018-02-05 19:51:22 +00:00
Documentation Documentation/Intel: Add NativeRaminit documentation 2017-12-09 16:59:16 +00:00
configs configs: Add intel/harcuvar FSP 2.0 sample configuration 2017-10-04 02:56:33 +00:00
payloads payload/tianocore: Fix patch to preserve coreboot table 2018-02-01 19:31:24 +00:00
src security/vboot: overwrite existing spaces during factory init for tpm2 2018-02-07 02:37:25 +00:00
util util/broadcom/secimage: Add HMAC test 2018-02-06 16:14:33 +00:00
.checkpatch.conf .checkpatch.conf: Ignore CORRUPTED_PATCH lint 2017-10-29 10:11:58 +00:00
.clang-format
.gitignore util/blobtool: rename to bincfg 2018-01-18 13:47:20 +00:00
.gitmodules
.gitreview
COPYING
MAINTAINERS MAINTAINERS: add maintainers for all PC Engines mainboards 2017-10-31 15:45:53 +00:00
Makefile Makefile: Add filelist to help 2018-01-29 15:35:11 +00:00
Makefile.inc util/gitconfig: Use `make` in git hooks 2018-01-23 05:18:14 +00:00
README
gnat.adc
toolchain.inc

README

-------------------------------------------------------------------------------
coreboot README
-------------------------------------------------------------------------------

coreboot is a Free Software project aimed at replacing the proprietary BIOS
(firmware) found in most computers.  coreboot performs a little bit of
hardware initialization and then executes additional boot logic, called a
payload.

With the separation of hardware initialization and later boot logic,
coreboot can scale from specialized applications that run directly
firmware, run operating systems in flash, load custom
bootloaders, or implement firmware standards, like PC BIOS services or
UEFI. This allows for systems to only include the features necessary
in the target application, reducing the amount of code and flash space
required.

coreboot was formerly known as LinuxBIOS.


Payloads
--------

After the basic initialization of the hardware has been performed, any
desired "payload" can be started by coreboot.

See https://www.coreboot.org/Payloads for a list of supported payloads.


Supported Hardware
------------------

coreboot supports a wide range of chipsets, devices, and mainboards.

For details please consult:

 * https://www.coreboot.org/Supported_Motherboards
 * https://www.coreboot.org/Supported_Chipsets_and_Devices


Build Requirements
------------------

 * make
 * gcc / g++
   Because Linux distribution compilers tend to use lots of patches. coreboot
   does lots of "unusual" things in its build system, some of which break due
   to those patches, sometimes by gcc aborting, sometimes - and that's worse -
   by generating broken object code.
   Two options: use our toolchain (eg. make crosstools-i386) or enable the
   ANY_TOOLCHAIN Kconfig option if you're feeling lucky (no support in this
   case).
 * iasl (for targets with ACPI support)
 * pkg-config
 * libssl-dev (openssl)

Optional:

 * doxygen (for generating/viewing documentation)
 * gdb (for better debugging facilities on some targets)
 * ncurses (for 'make menuconfig' and 'make nconfig')
 * flex and bison (for regenerating parsers)


Building coreboot
-----------------

Please consult https://www.coreboot.org/Build_HOWTO for details.


Testing coreboot Without Modifying Your Hardware
------------------------------------------------

If you want to test coreboot without any risks before you really decide
to use it on your hardware, you can use the QEMU system emulator to run
coreboot virtually in QEMU.

Please see https://www.coreboot.org/QEMU for details.


Website and Mailing List
------------------------

Further details on the project, a FAQ, many HOWTOs, news, development
guidelines and more can be found on the coreboot website:

  https://www.coreboot.org

You can contact us directly on the coreboot mailing list:

  https://www.coreboot.org/Mailinglist


Copyright and License
---------------------

The copyright on coreboot is owned by quite a large number of individual
developers and companies. Please check the individual source files for details.

coreboot is licensed under the terms of the GNU General Public License (GPL).
Some files are licensed under the "GPL (version 2, or any later version)",
and some files are licensed under the "GPL, version 2". For some parts, which
were derived from other projects, other (GPL-compatible) licenses may apply.
Please check the individual source files for details.

This makes the resulting coreboot images licensed under the GPL, version 2.