No description
8727e644ea
All coreboot stages using TPM start with the same sequence: check if
locality is claimed, if so, release it by writing 'active locality'
bit, then try claiming it.
This is actually not a proper procedure: section "5.5.2.3.1 Command
Aborts" of "TCG PC Client Platform TPM Profile (PTP) Specification
Level 00 Revision 00.430 Family 2" lists overwriting active locality
status bit as a means of triggering TPM command abort.
On top of that, none of the coreboot stages releases locality, it is
enough to claim it once when device starts booting.
In fact, locality being active when the device is in verstage is most
likely due to delayed TPM reset processing by the Cr50 TPM: reset is
an asynchronous event, and is processed once current command
processing completes.
The proper procedure is to wait if locality is active until it is
released (which will happen when Cr50 processes reset) and then
proceed to claim it. This needs to happen only during verstage, other
stages using TPM are guaranteed has been claimed earlier.
BRANCH=gru
BUG=b:65867313
TEST=the new autotest triggering EC reset during key generation
process does not cause boot failures on Fizz device any more.
Below are times verstage had to wait:
TPM ready after 3132 ms
TPM ready after 22120 ms
TPM ready after 4936 ms
TPM ready after 6445 ms
TPM ready after 11798 ms
TPM ready after 27421 ms
TPM ready after 4582 ms
TPM ready after 7532 ms
TPM ready after 27920 ms
TPM ready after 3539 ms
TPM ready after 12557 ms
TPM ready after 6773 ms
TPM ready after 1631 ms
TPM ready after 197 ms
TPM ready after 24330 ms
TPM ready after 3241 ms
Change-Id: Iaee04f009bcde03712483e5e03de4a3441ea32b1
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://review.coreboot.org/22489
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
Reviewed-by: Julius Werner <jwerner@chromium.org>
Reviewed-by: Furquan Shaikh <furquan@google.com>
|
||
|---|---|---|
| 3rdparty | ||
| configs | ||
| Documentation | ||
| payloads | ||
| src | ||
| util | ||
| .checkpatch.conf | ||
| .clang-format | ||
| .gitignore | ||
| .gitmodules | ||
| .gitreview | ||
| COPYING | ||
| gnat.adc | ||
| MAINTAINERS | ||
| Makefile | ||
| Makefile.inc | ||
| README | ||
| toolchain.inc | ||
------------------------------------------------------------------------------- coreboot README ------------------------------------------------------------------------------- coreboot is a Free Software project aimed at replacing the proprietary BIOS (firmware) found in most computers. coreboot performs a little bit of hardware initialization and then executes additional boot logic, called a payload. With the separation of hardware initialization and later boot logic, coreboot can scale from specialized applications that run directly firmware, run operating systems in flash, load custom bootloaders, or implement firmware standards, like PC BIOS services or UEFI. This allows for systems to only include the features necessary in the target application, reducing the amount of code and flash space required. coreboot was formerly known as LinuxBIOS. Payloads -------- After the basic initialization of the hardware has been performed, any desired "payload" can be started by coreboot. See https://www.coreboot.org/Payloads for a list of supported payloads. Supported Hardware ------------------ coreboot supports a wide range of chipsets, devices, and mainboards. For details please consult: * https://www.coreboot.org/Supported_Motherboards * https://www.coreboot.org/Supported_Chipsets_and_Devices Build Requirements ------------------ * make * gcc / g++ Because Linux distribution compilers tend to use lots of patches. coreboot does lots of "unusual" things in its build system, some of which break due to those patches, sometimes by gcc aborting, sometimes - and that's worse - by generating broken object code. Two options: use our toolchain (eg. make crosstools-i386) or enable the ANY_TOOLCHAIN Kconfig option if you're feeling lucky (no support in this case). * iasl (for targets with ACPI support) * pkg-config * libssl-dev (openssl) Optional: * doxygen (for generating/viewing documentation) * gdb (for better debugging facilities on some targets) * ncurses (for 'make menuconfig' and 'make nconfig') * flex and bison (for regenerating parsers) Building coreboot ----------------- Please consult https://www.coreboot.org/Build_HOWTO for details. Testing coreboot Without Modifying Your Hardware ------------------------------------------------ If you want to test coreboot without any risks before you really decide to use it on your hardware, you can use the QEMU system emulator to run coreboot virtually in QEMU. Please see https://www.coreboot.org/QEMU for details. Website and Mailing List ------------------------ Further details on the project, a FAQ, many HOWTOs, news, development guidelines and more can be found on the coreboot website: https://www.coreboot.org You can contact us directly on the coreboot mailing list: https://www.coreboot.org/Mailinglist Copyright and License --------------------- The copyright on coreboot is owned by quite a large number of individual developers and companies. Please check the individual source files for details. coreboot is licensed under the terms of the GNU General Public License (GPL). Some files are licensed under the "GPL (version 2, or any later version)", and some files are licensed under the "GPL, version 2". For some parts, which were derived from other projects, other (GPL-compatible) licenses may apply. Please check the individual source files for details. This makes the resulting coreboot images licensed under the GPL, version 2.