2017-08-22 03:40:17 +00:00
|
|
|
diff --git ./src/Kconfig ./src/Kconfig
|
2018-01-10 21:28:28 +00:00
|
|
|
index 49f8672ff2..4ca811df77 100644
|
2017-08-22 03:40:17 +00:00
|
|
|
--- ./src/Kconfig
|
|
|
|
+++ ./src/Kconfig
|
|
|
|
@@ -259,6 +259,21 @@ config BOOTSPLASH_FILE
|
2017-02-01 16:50:52 +00:00
|
|
|
The path and filename of the file to use as graphical bootsplash
|
|
|
|
screen. The file format has to be jpg.
|
|
|
|
|
|
|
|
+config MEASURED_BOOT
|
|
|
|
+ bool "Enable TPM measured boot"
|
|
|
|
+ default n
|
|
|
|
+ select TPM
|
|
|
|
+ depends on MAINBOARD_HAS_LPC_TPM
|
|
|
|
+ depends on !VBOOT
|
|
|
|
+ help
|
|
|
|
+ Enable this option to measure the bootblock, romstage and
|
|
|
|
+ CBFS files into TPM PCRs. This does not verify these values
|
|
|
|
+ (that is the job of something like vboot), but makes it possible
|
|
|
|
+ for the payload to validate the boot path and allow something
|
|
|
|
+ like Heads to attest to the user that the system is likely safe.
|
|
|
|
+
|
|
|
|
+ You probably want to say N.
|
|
|
|
+
|
|
|
|
endmenu
|
|
|
|
|
|
|
|
menu "Mainboard"
|
2017-08-27 19:39:22 +00:00
|
|
|
diff --git ./src/include/program_loading.h ./src/include/program_loading.h
|
2018-01-10 21:28:28 +00:00
|
|
|
index 416e2e9418..40486cdfed 100644
|
2017-08-27 19:39:22 +00:00
|
|
|
--- ./src/include/program_loading.h
|
|
|
|
+++ ./src/include/program_loading.h
|
|
|
|
@@ -24,6 +24,8 @@ enum {
|
|
|
|
/* Last segment of program. Can be used to take different actions for
|
|
|
|
* cache maintenance of a program load. */
|
|
|
|
SEG_FINAL = 1 << 0,
|
|
|
|
+ /* Indicate that the program segment should not be measured */
|
|
|
|
+ SEG_NO_MEASURE = 1 << 1,
|
|
|
|
};
|
|
|
|
|
|
|
|
enum prog_type {
|
2017-08-22 03:40:17 +00:00
|
|
|
diff --git ./src/include/sha1.h ./src/include/sha1.h
|
2017-02-01 16:50:52 +00:00
|
|
|
new file mode 100644
|
2018-01-10 21:28:28 +00:00
|
|
|
index 0000000000..e7e28e6cdb
|
2017-02-01 16:50:52 +00:00
|
|
|
--- /dev/null
|
2017-08-22 03:40:17 +00:00
|
|
|
+++ ./src/include/sha1.h
|
2017-02-01 16:50:52 +00:00
|
|
|
@@ -0,0 +1,31 @@
|
|
|
|
+/* Copyright (c) 2014 The Chromium OS Authors. All rights reserved.
|
|
|
|
+ * Use of this source code is governed by a BSD-style license that can be
|
|
|
|
+ * found in the LICENSE file.
|
|
|
|
+ */
|
|
|
|
+
|
|
|
|
+/* SHA-1 functions */
|
|
|
|
+
|
|
|
|
+#ifndef _sha1_h_
|
|
|
|
+#define _sha1_h_
|
|
|
|
+
|
|
|
|
+#include <stdint.h>
|
|
|
|
+#include <commonlib/helpers.h>
|
|
|
|
+
|
|
|
|
+#define SHA1_DIGEST_SIZE 20
|
|
|
|
+#define SHA1_BLOCK_SIZE 64
|
|
|
|
+
|
|
|
|
+/* SHA-1 context */
|
|
|
|
+struct sha1_ctx {
|
|
|
|
+ uint32_t count;
|
|
|
|
+ uint32_t state[5];
|
|
|
|
+ union {
|
|
|
|
+ uint8_t b[SHA1_BLOCK_SIZE];
|
|
|
|
+ uint32_t w[DIV_ROUND_UP(SHA1_BLOCK_SIZE, sizeof(uint32_t))];
|
|
|
|
+ } buf;
|
|
|
|
+};
|
|
|
|
+
|
|
|
|
+void sha1_init(struct sha1_ctx *ctx);
|
|
|
|
+void sha1_update(struct sha1_ctx *ctx, const uint8_t *data, uint32_t len);
|
|
|
|
+uint8_t *sha1_final(struct sha1_ctx *ctx);
|
|
|
|
+
|
|
|
|
+#endif /* _sha1_h_ */
|
2017-08-22 03:40:17 +00:00
|
|
|
diff --git ./src/include/tpm_lite/tlcl.h ./src/include/tpm_lite/tlcl.h
|
2018-01-10 21:28:28 +00:00
|
|
|
index 8dd5d80685..15fbebfde3 100644
|
2017-08-22 03:40:17 +00:00
|
|
|
--- ./src/include/tpm_lite/tlcl.h
|
|
|
|
+++ ./src/include/tpm_lite/tlcl.h
|
2017-02-01 16:50:52 +00:00
|
|
|
@@ -147,6 +147,11 @@ uint32_t tlcl_extend(int pcr_num, const uint8_t *in_digest,
|
2017-08-22 03:40:17 +00:00
|
|
|
uint8_t *out_digest);
|
2017-02-01 16:50:52 +00:00
|
|
|
|
|
|
|
/**
|
|
|
|
+ * Perform a SHA1 hash on a region and extend a PCR with the hash.
|
|
|
|
+ */
|
|
|
|
+uint32_t tlcl_measure(int pcr_num, const void * start, size_t len);
|
|
|
|
+
|
|
|
|
+/**
|
|
|
|
* Get the entire set of permanent flags.
|
|
|
|
*/
|
|
|
|
uint32_t tlcl_get_permanent_flags(TPM_PERMANENT_FLAGS *pflags);
|
2017-08-22 03:40:17 +00:00
|
|
|
diff --git ./src/lib/Makefile.inc ./src/lib/Makefile.inc
|
2018-01-10 21:28:28 +00:00
|
|
|
index 8f92b291bb..1822daf301 100644
|
2017-08-22 03:40:17 +00:00
|
|
|
--- ./src/lib/Makefile.inc
|
|
|
|
+++ ./src/lib/Makefile.inc
|
|
|
|
@@ -54,8 +54,13 @@ verstage-$(CONFIG_TPM) += tlcl.c
|
|
|
|
verstage-$(CONFIG_TPM2) += tpm2_marshaling.c
|
|
|
|
verstage-$(CONFIG_TPM2) += tpm2_tlcl.c
|
|
|
|
|
|
|
|
-ifeq ($(CONFIG_VBOOT_SEPARATE_VERSTAGE),y)
|
2017-02-01 16:50:52 +00:00
|
|
|
+# Add the TPM support into the ROM stage for measuring the bootblock
|
2017-08-22 03:40:17 +00:00
|
|
|
romstage-$(CONFIG_TPM) += tlcl.c
|
2017-02-01 16:50:52 +00:00
|
|
|
+romstage-$(CONFIG_TPM) += sha1.c
|
|
|
|
+ramstage-$(CONFIG_TPM) += tlcl.c
|
|
|
|
+ramstage-$(CONFIG_TPM) += sha1.c
|
2017-08-22 03:40:17 +00:00
|
|
|
+
|
|
|
|
+ifeq ($(CONFIG_VBOOT_SEPARATE_VERSTAGE),y)
|
|
|
|
romstage-$(CONFIG_TPM2) += tpm2_marshaling.c
|
|
|
|
romstage-$(CONFIG_TPM2) += tpm2_tlcl.c
|
|
|
|
endif # CONFIG_VBOOT_SEPARATE_VERSTAGE
|
|
|
|
diff --git ./src/lib/cbfs.c ./src/lib/cbfs.c
|
2018-01-10 21:28:28 +00:00
|
|
|
index 11bce2c530..8428245f7f 100644
|
2017-08-22 03:40:17 +00:00
|
|
|
--- ./src/lib/cbfs.c
|
|
|
|
+++ ./src/lib/cbfs.c
|
|
|
|
@@ -69,7 +69,11 @@ void *cbfs_boot_map_with_leak(const char *name, uint32_t type, size_t *size)
|
2017-02-01 16:50:52 +00:00
|
|
|
if (size != NULL)
|
|
|
|
*size = fsize;
|
|
|
|
|
|
|
|
- return rdev_mmap(&fh.data, 0, fsize);
|
|
|
|
+ void * buffer = rdev_mmap(&fh.data, 0, fsize);
|
|
|
|
+
|
2017-08-27 19:39:22 +00:00
|
|
|
+ prog_segment_loaded((uintptr_t)buffer, fsize, 0);
|
2017-02-01 16:50:52 +00:00
|
|
|
+
|
|
|
|
+ return buffer;
|
|
|
|
}
|
|
|
|
|
2017-08-22 03:40:17 +00:00
|
|
|
int cbfs_locate_file_in_region(struct cbfsf *fh, const char *region_name,
|
|
|
|
@@ -97,7 +101,8 @@ size_t cbfs_load_and_decompress(const struct region_device *rdev, size_t offset,
|
2017-02-01 16:50:52 +00:00
|
|
|
return 0;
|
|
|
|
if (rdev_readat(rdev, buffer, offset, in_size) != in_size)
|
|
|
|
return 0;
|
|
|
|
- return in_size;
|
|
|
|
+ out_size = in_size;
|
|
|
|
+ break;
|
|
|
|
|
|
|
|
case CBFS_COMPRESS_LZ4:
|
|
|
|
if ((ENV_BOOTBLOCK || ENV_VERSTAGE) &&
|
2017-08-22 03:40:17 +00:00
|
|
|
@@ -115,7 +120,7 @@ size_t cbfs_load_and_decompress(const struct region_device *rdev, size_t offset,
|
2017-02-01 16:50:52 +00:00
|
|
|
timestamp_add_now(TS_START_ULZ4F);
|
|
|
|
out_size = ulz4fn(compr_start, in_size, buffer, buffer_size);
|
|
|
|
timestamp_add_now(TS_END_ULZ4F);
|
|
|
|
- return out_size;
|
|
|
|
+ break;
|
|
|
|
|
|
|
|
case CBFS_COMPRESS_LZMA:
|
|
|
|
if (ENV_BOOTBLOCK || ENV_VERSTAGE)
|
2017-08-22 03:40:17 +00:00
|
|
|
@@ -134,11 +139,15 @@ size_t cbfs_load_and_decompress(const struct region_device *rdev, size_t offset,
|
2017-02-01 16:50:52 +00:00
|
|
|
|
|
|
|
rdev_munmap(rdev, map);
|
|
|
|
|
|
|
|
- return out_size;
|
|
|
|
+ break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
+
|
2017-08-27 19:39:22 +00:00
|
|
|
+ prog_segment_loaded((uintptr_t)buffer, out_size, 0);
|
2017-02-01 16:50:52 +00:00
|
|
|
+
|
|
|
|
+ return out_size;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int tohex4(unsigned int c)
|
2017-08-22 03:40:17 +00:00
|
|
|
diff --git ./src/lib/hardwaremain.c ./src/lib/hardwaremain.c
|
2018-01-10 21:28:28 +00:00
|
|
|
index a56d68e3f5..8c13f5f2e6 100644
|
2017-08-22 03:40:17 +00:00
|
|
|
--- ./src/lib/hardwaremain.c
|
|
|
|
+++ ./src/lib/hardwaremain.c
|
|
|
|
@@ -32,6 +32,7 @@
|
2017-02-01 16:50:52 +00:00
|
|
|
#include <reset.h>
|
|
|
|
#include <boot/tables.h>
|
|
|
|
#include <program_loading.h>
|
|
|
|
+#include <tpm_lite/tlcl.h>
|
|
|
|
#include <lib.h>
|
|
|
|
#if CONFIG_HAVE_ACPI_RESUME
|
|
|
|
#include <arch/acpi.h>
|
2017-08-22 03:40:17 +00:00
|
|
|
@@ -544,3 +545,13 @@ void boot_state_current_unblock(void)
|
2017-02-01 16:50:52 +00:00
|
|
|
{
|
|
|
|
boot_state_unblock(current_phase.state_id, current_phase.seq);
|
|
|
|
}
|
|
|
|
+
|
|
|
|
+// ramstage measurements go into PCR3 if we are doing measured boot
|
|
|
|
+void platform_segment_loaded(uintptr_t start, size_t size, int flags)
|
|
|
|
+{
|
2017-08-27 19:39:22 +00:00
|
|
|
+ if (IS_ENABLED(CONFIG_MEASURED_BOOT) && !(flags & SEG_NO_MEASURE))
|
2017-02-01 16:50:52 +00:00
|
|
|
+ {
|
|
|
|
+ tlcl_measure(3, (const void*) start, size);
|
|
|
|
+ }
|
|
|
|
+}
|
|
|
|
+
|
2017-08-22 03:40:17 +00:00
|
|
|
diff --git ./src/lib/rmodule.c ./src/lib/rmodule.c
|
2018-01-10 21:28:28 +00:00
|
|
|
index a3a74ac613..bb99e5f9f8 100644
|
2017-08-22 03:40:17 +00:00
|
|
|
--- ./src/lib/rmodule.c
|
|
|
|
+++ ./src/lib/rmodule.c
|
2017-08-27 19:39:22 +00:00
|
|
|
@@ -198,7 +198,7 @@ int rmodule_load(void *base, struct rmodule *module)
|
|
|
|
rmodule_clear_bss(module);
|
2017-02-01 16:50:52 +00:00
|
|
|
|
2017-08-27 19:39:22 +00:00
|
|
|
prog_segment_loaded((uintptr_t)module->location,
|
|
|
|
- rmodule_memory_size(module), SEG_FINAL);
|
|
|
|
+ rmodule_memory_size(module), SEG_FINAL | SEG_NO_MEASURE);
|
2017-02-01 16:50:52 +00:00
|
|
|
|
2017-08-27 19:39:22 +00:00
|
|
|
return 0;
|
|
|
|
}
|
2017-08-22 03:40:17 +00:00
|
|
|
diff --git ./src/lib/sha1.c ./src/lib/sha1.c
|
2017-02-01 16:50:52 +00:00
|
|
|
new file mode 100644
|
2018-01-10 21:28:28 +00:00
|
|
|
index 0000000000..506907fde1
|
2017-02-01 16:50:52 +00:00
|
|
|
--- /dev/null
|
2017-08-22 03:40:17 +00:00
|
|
|
+++ ./src/lib/sha1.c
|
2017-02-01 16:50:52 +00:00
|
|
|
@@ -0,0 +1,175 @@
|
|
|
|
+/* Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
|
|
|
|
+ * Use of this source code is governed by a BSD-style license that can be
|
|
|
|
+ * found in the LICENSE file.
|
|
|
|
+ *
|
|
|
|
+ * SHA-1 implementation largely based on libmincrypt in the the Android
|
|
|
|
+ * Open Source Project (platorm/system/core.git/libmincrypt/sha.c
|
|
|
|
+ */
|
|
|
|
+
|
|
|
|
+#include "sha1.h"
|
|
|
|
+#include <string.h>
|
|
|
|
+
|
|
|
|
+static uint32_t ror27(uint32_t val)
|
|
|
|
+{
|
|
|
|
+ return (val >> 27) | (val << 5);
|
|
|
|
+}
|
|
|
|
+static uint32_t ror2(uint32_t val)
|
|
|
|
+{
|
|
|
|
+ return (val >> 2) | (val << 30);
|
|
|
|
+}
|
|
|
|
+static uint32_t ror31(uint32_t val)
|
|
|
|
+{
|
|
|
|
+ return (val >> 31) | (val << 1);
|
|
|
|
+}
|
|
|
|
+
|
|
|
|
+static void sha1_transform(struct sha1_ctx *ctx)
|
|
|
|
+{
|
|
|
|
+ uint32_t W[80];
|
|
|
|
+ register uint32_t A, B, C, D, E;
|
|
|
|
+ int t;
|
|
|
|
+
|
|
|
|
+ A = ctx->state[0];
|
|
|
|
+ B = ctx->state[1];
|
|
|
|
+ C = ctx->state[2];
|
|
|
|
+ D = ctx->state[3];
|
|
|
|
+ E = ctx->state[4];
|
|
|
|
+
|
|
|
|
+#define SHA_F1(A, B, C, D, E, t) \
|
|
|
|
+ E += ror27(A) + \
|
|
|
|
+ (W[t] = __builtin_bswap32(ctx->buf.w[t])) + \
|
|
|
|
+ (D^(B&(C^D))) + 0x5A827999; \
|
|
|
|
+ B = ror2(B);
|
|
|
|
+
|
|
|
|
+ for (t = 0; t < 15; t += 5) {
|
|
|
|
+ SHA_F1(A, B, C, D, E, t + 0);
|
|
|
|
+ SHA_F1(E, A, B, C, D, t + 1);
|
|
|
|
+ SHA_F1(D, E, A, B, C, t + 2);
|
|
|
|
+ SHA_F1(C, D, E, A, B, t + 3);
|
|
|
|
+ SHA_F1(B, C, D, E, A, t + 4);
|
|
|
|
+ }
|
|
|
|
+ SHA_F1(A, B, C, D, E, t + 0); /* 16th one, t == 15 */
|
|
|
|
+
|
|
|
|
+#undef SHA_F1
|
|
|
|
+
|
|
|
|
+#define SHA_F1(A, B, C, D, E, t) \
|
|
|
|
+ E += ror27(A) + \
|
|
|
|
+ (W[t] = ror31(W[t-3] ^ W[t-8] ^ W[t-14] ^ W[t-16])) + \
|
|
|
|
+ (D^(B&(C^D))) + 0x5A827999; \
|
|
|
|
+ B = ror2(B);
|
|
|
|
+
|
|
|
|
+ SHA_F1(E, A, B, C, D, t + 1);
|
|
|
|
+ SHA_F1(D, E, A, B, C, t + 2);
|
|
|
|
+ SHA_F1(C, D, E, A, B, t + 3);
|
|
|
|
+ SHA_F1(B, C, D, E, A, t + 4);
|
|
|
|
+
|
|
|
|
+#undef SHA_F1
|
|
|
|
+
|
|
|
|
+#define SHA_F2(A, B, C, D, E, t) \
|
|
|
|
+ E += ror27(A) + \
|
|
|
|
+ (W[t] = ror31(W[t-3] ^ W[t-8] ^ W[t-14] ^ W[t-16])) + \
|
|
|
|
+ (B^C^D) + 0x6ED9EBA1; \
|
|
|
|
+ B = ror2(B);
|
|
|
|
+
|
|
|
|
+ for (t = 20; t < 40; t += 5) {
|
|
|
|
+ SHA_F2(A, B, C, D, E, t + 0);
|
|
|
|
+ SHA_F2(E, A, B, C, D, t + 1);
|
|
|
|
+ SHA_F2(D, E, A, B, C, t + 2);
|
|
|
|
+ SHA_F2(C, D, E, A, B, t + 3);
|
|
|
|
+ SHA_F2(B, C, D, E, A, t + 4);
|
|
|
|
+ }
|
|
|
|
+
|
|
|
|
+#undef SHA_F2
|
|
|
|
+
|
|
|
|
+#define SHA_F3(A, B, C, D, E, t) \
|
|
|
|
+ E += ror27(A) + \
|
|
|
|
+ (W[t] = ror31(W[t-3] ^ W[t-8] ^ W[t-14] ^ W[t-16])) + \
|
|
|
|
+ ((B&C)|(D&(B|C))) + 0x8F1BBCDC; \
|
|
|
|
+ B = ror2(B);
|
|
|
|
+
|
|
|
|
+ for (; t < 60; t += 5) {
|
|
|
|
+ SHA_F3(A, B, C, D, E, t + 0);
|
|
|
|
+ SHA_F3(E, A, B, C, D, t + 1);
|
|
|
|
+ SHA_F3(D, E, A, B, C, t + 2);
|
|
|
|
+ SHA_F3(C, D, E, A, B, t + 3);
|
|
|
|
+ SHA_F3(B, C, D, E, A, t + 4);
|
|
|
|
+ }
|
|
|
|
+
|
|
|
|
+#undef SHA_F3
|
|
|
|
+
|
|
|
|
+#define SHA_F4(A, B, C, D, E, t) \
|
|
|
|
+ E += ror27(A) + \
|
|
|
|
+ (W[t] = ror31(W[t-3] ^ W[t-8] ^ W[t-14] ^ W[t-16])) + \
|
|
|
|
+ (B^C^D) + 0xCA62C1D6; \
|
|
|
|
+ B = ror2(B);
|
|
|
|
+
|
|
|
|
+ for (; t < 80; t += 5) {
|
|
|
|
+ SHA_F4(A, B, C, D, E, t + 0);
|
|
|
|
+ SHA_F4(E, A, B, C, D, t + 1);
|
|
|
|
+ SHA_F4(D, E, A, B, C, t + 2);
|
|
|
|
+ SHA_F4(C, D, E, A, B, t + 3);
|
|
|
|
+ SHA_F4(B, C, D, E, A, t + 4);
|
|
|
|
+ }
|
|
|
|
+
|
|
|
|
+#undef SHA_F4
|
|
|
|
+
|
|
|
|
+ ctx->state[0] += A;
|
|
|
|
+ ctx->state[1] += B;
|
|
|
|
+ ctx->state[2] += C;
|
|
|
|
+ ctx->state[3] += D;
|
|
|
|
+ ctx->state[4] += E;
|
|
|
|
+}
|
|
|
|
+
|
|
|
|
+void sha1_update(struct sha1_ctx *ctx, const uint8_t *data, uint32_t len)
|
|
|
|
+{
|
|
|
|
+ int i = ctx->count % sizeof(ctx->buf);
|
|
|
|
+ const uint8_t *p = (const uint8_t *)data;
|
|
|
|
+
|
|
|
|
+ ctx->count += len;
|
|
|
|
+
|
|
|
|
+ while (len > sizeof(ctx->buf) - i) {
|
|
|
|
+ memcpy(&ctx->buf.b[i], p, sizeof(ctx->buf) - i);
|
|
|
|
+ len -= sizeof(ctx->buf) - i;
|
|
|
|
+ p += sizeof(ctx->buf) - i;
|
|
|
|
+ sha1_transform(ctx);
|
|
|
|
+ i = 0;
|
|
|
|
+ }
|
|
|
|
+
|
|
|
|
+ while (len--) {
|
|
|
|
+ ctx->buf.b[i++] = *p++;
|
|
|
|
+ if (i == sizeof(ctx->buf)) {
|
|
|
|
+ sha1_transform(ctx);
|
|
|
|
+ i = 0;
|
|
|
|
+ }
|
|
|
|
+ }
|
|
|
|
+}
|
|
|
|
+
|
|
|
|
+
|
|
|
|
+uint8_t *sha1_final(struct sha1_ctx *ctx)
|
|
|
|
+{
|
|
|
|
+ uint32_t cnt = ctx->count * 8;
|
|
|
|
+ int i;
|
|
|
|
+
|
|
|
|
+ sha1_update(ctx, (uint8_t *)"\x80", 1);
|
|
|
|
+ while ((ctx->count % sizeof(ctx->buf)) != (sizeof(ctx->buf) - 8))
|
|
|
|
+ sha1_update(ctx, (uint8_t *)"\0", 1);
|
|
|
|
+
|
|
|
|
+ for (i = 0; i < 8; ++i) {
|
|
|
|
+ uint8_t tmp = cnt >> ((7 - i) * 8);
|
|
|
|
+ sha1_update(ctx, &tmp, 1);
|
|
|
|
+ }
|
|
|
|
+
|
|
|
|
+ for (i = 0; i < 5; i++)
|
|
|
|
+ ctx->buf.w[i] = __builtin_bswap32(ctx->state[i]);
|
|
|
|
+
|
|
|
|
+ return ctx->buf.b;
|
|
|
|
+}
|
|
|
|
+
|
|
|
|
+void sha1_init(struct sha1_ctx *ctx)
|
|
|
|
+{
|
|
|
|
+ ctx->state[0] = 0x67452301;
|
|
|
|
+ ctx->state[1] = 0xEFCDAB89;
|
|
|
|
+ ctx->state[2] = 0x98BADCFE;
|
|
|
|
+ ctx->state[3] = 0x10325476;
|
|
|
|
+ ctx->state[4] = 0xC3D2E1F0;
|
|
|
|
+ ctx->count = 0;
|
|
|
|
+}
|
2017-08-22 03:40:17 +00:00
|
|
|
diff --git ./src/lib/tlcl.c ./src/lib/tlcl.c
|
2018-01-10 21:28:28 +00:00
|
|
|
index 49854cbdcb..32eb128913 100644
|
2017-08-22 03:40:17 +00:00
|
|
|
--- ./src/lib/tlcl.c
|
|
|
|
+++ ./src/lib/tlcl.c
|
|
|
|
@@ -19,6 +19,7 @@
|
2017-02-01 16:50:52 +00:00
|
|
|
#include <string.h>
|
|
|
|
#include <tpm_lite/tlcl.h>
|
|
|
|
#include <tpm.h>
|
|
|
|
+#include <sha1.h>
|
|
|
|
#include <vb2_api.h>
|
|
|
|
#include "tlcl_internal.h"
|
|
|
|
#include "tlcl_structures.h"
|
2017-08-22 03:40:17 +00:00
|
|
|
@@ -351,3 +352,23 @@ uint32_t tlcl_extend(int pcr_num, const uint8_t *in_digest,
|
2017-02-01 16:50:52 +00:00
|
|
|
kPcrDigestLength);
|
|
|
|
return result;
|
|
|
|
}
|
|
|
|
+
|
|
|
|
+
|
|
|
|
+uint32_t tlcl_measure(int pcr_num, const void * start, size_t len)
|
|
|
|
+{
|
|
|
|
+ VBDEBUG("TPM: pcr %d measure %p @ %zu: ", pcr_num, start, len);
|
|
|
|
+
|
|
|
|
+ struct sha1_ctx sha;
|
|
|
|
+ sha1_init(&sha);
|
|
|
|
+ sha1_update(&sha, start, len);
|
|
|
|
+
|
|
|
|
+ const uint8_t * hash = sha1_final(&sha);
|
|
|
|
+ for(unsigned i = 0 ; i < SHA1_DIGEST_SIZE ; i++)
|
|
|
|
+ VBDEBUG("%02x", hash[i]);
|
|
|
|
+ VBDEBUG("\n");
|
|
|
|
+
|
|
|
|
+ //hexdump(start, 128);
|
|
|
|
+
|
|
|
|
+ return tlcl_extend(pcr_num, hash, NULL);
|
|
|
|
+}
|
|
|
|
+
|
2017-08-22 03:40:17 +00:00
|
|
|
diff --git ./src/northbridge/intel/sandybridge/romstage.c ./src/northbridge/intel/sandybridge/romstage.c
|
2018-01-10 21:28:28 +00:00
|
|
|
index 738e2851af..c7c0c628d4 100644
|
2017-08-22 03:40:17 +00:00
|
|
|
--- ./src/northbridge/intel/sandybridge/romstage.c
|
|
|
|
+++ ./src/northbridge/intel/sandybridge/romstage.c
|
2017-02-01 16:50:52 +00:00
|
|
|
@@ -29,6 +29,8 @@
|
|
|
|
#include <device/device.h>
|
|
|
|
#include <halt.h>
|
|
|
|
#include <tpm.h>
|
|
|
|
+#include <tpm_lite/tlcl.h>
|
|
|
|
+#include <program_loading.h>
|
|
|
|
#include <northbridge/intel/sandybridge/chip.h>
|
|
|
|
#include "southbridge/intel/bd82x6x/pch.h"
|
|
|
|
#include <southbridge/intel/common/gpio.h>
|
|
|
|
@@ -72,6 +74,18 @@ void mainboard_romstage_entry(unsigned long bist)
|
|
|
|
/* Initialize superio */
|
|
|
|
mainboard_config_superio();
|
|
|
|
|
|
|
|
+ if (IS_ENABLED(CONFIG_MEASURED_BOOT) && IS_ENABLED(CONFIG_LPC_TPM)) {
|
|
|
|
+ // we don't know if we are coming out of a resume
|
|
|
|
+ // at this point, but want to setup the tpm ASAP
|
|
|
|
+ init_tpm(0);
|
|
|
|
+ const void * const bootblock = (const void*) 0xFFFFF800;
|
|
|
|
+ const unsigned bootblock_size = 0x800;
|
|
|
|
+ tlcl_measure(0, bootblock, bootblock_size);
|
|
|
|
+
|
|
|
|
+ extern char _romstage, _eromstage;
|
|
|
|
+ tlcl_measure(1, &_romstage, &_eromstage - &_romstage);
|
|
|
|
+ }
|
|
|
|
+
|
2017-08-22 03:40:17 +00:00
|
|
|
/* USB is initialized in MRC if MRC is used. */
|
2017-02-01 16:50:52 +00:00
|
|
|
if (CONFIG_USE_NATIVE_RAMINIT) {
|
|
|
|
early_usb_init(mainboard_usb_ports);
|
|
|
|
@@ -116,9 +130,23 @@ void mainboard_romstage_entry(unsigned long bist)
|
|
|
|
|
|
|
|
northbridge_romstage_finalize(s3resume);
|
|
|
|
|
|
|
|
- if (IS_ENABLED(CONFIG_LPC_TPM)) {
|
|
|
|
+ // the normal TPM init happens here, if we haven't already
|
|
|
|
+ // set it up as part of the measured boot.
|
|
|
|
+ if (!IS_ENABLED(CONFIG_MEASURED_BOOT) && IS_ENABLED(CONFIG_LPC_TPM)) {
|
|
|
|
init_tpm(s3resume);
|
|
|
|
}
|
|
|
|
|
|
|
|
+ printk(BIOS_DEBUG, "%s: romstage complete\n", __FILE__);
|
|
|
|
+
|
|
|
|
post_code(0x3f);
|
|
|
|
}
|
|
|
|
+
|
|
|
|
+
|
|
|
|
+void platform_segment_loaded(uintptr_t start, size_t size, int flags)
|
|
|
|
+{
|
2017-08-27 19:39:22 +00:00
|
|
|
+ if (IS_ENABLED(CONFIG_MEASURED_BOOT) && !(flags & SEG_NO_MEASURE))
|
2017-02-01 16:50:52 +00:00
|
|
|
+ {
|
|
|
|
+ tlcl_measure(2, (const void*) start, size);
|
|
|
|
+ }
|
|
|
|
+}
|
|
|
|
+
|
2017-12-02 20:14:42 +00:00
|
|
|
diff --git ./util/cbfstool/lz4/lib/lz4frame.c ./util/cbfstool/lz4/lib/lz4frame.c
|
2018-01-10 21:28:28 +00:00
|
|
|
index e5458bb9e4..58fb68fbb3 100644
|
2017-12-02 20:14:42 +00:00
|
|
|
--- ./util/cbfstool/lz4/lib/lz4frame.c
|
|
|
|
+++ ./util/cbfstool/lz4/lib/lz4frame.c
|
|
|
|
@@ -1091,7 +1091,7 @@ size_t LZ4F_decompress(LZ4F_decompressionContext_t decompressionContext,
|
|
|
|
dctxPtr->tmpInTarget = minFHSize; /* minimum to attempt decode */
|
|
|
|
dctxPtr->dStage = dstage_storeHeader;
|
|
|
|
}
|
|
|
|
-
|
|
|
|
+ /* Falls through. */
|
|
|
|
case dstage_storeHeader:
|
|
|
|
{
|
|
|
|
size_t sizeToCopy = dctxPtr->tmpInTarget - dctxPtr->tmpInSize;
|
2018-01-10 21:28:28 +00:00
|
|
|
diff --git ./util/crossgcc/patches/gcc-6.3.0_pointer_integer.patch ./util/crossgcc/patches/gcc-6.3.0_pointer_integer.patch
|
|
|
|
new file mode 100644
|
|
|
|
index 0000000000..f34d6cc36e
|
|
|
|
--- /dev/null
|
|
|
|
+++ ./util/crossgcc/patches/gcc-6.3.0_pointer_integer.patch
|
|
|
|
@@ -0,0 +1,27 @@
|
|
|
|
+From 8db2cf6353c13f2a84cbe49b689654897906c499 Mon Sep 17 00:00:00 2001
|
|
|
|
+From: kyukhin <kyukhin@138bc75d-0d04-0410-961f-82ee72b054a4>
|
|
|
|
+Date: Sat, 3 Sep 2016 10:57:05 +0000
|
|
|
|
+Subject: [PATCH] gcc/ * ubsan.c (ubsan_use_new_style_p): Fix check for empty
|
|
|
|
+ string.
|
|
|
|
+
|
|
|
|
+git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/trunk@239971 138bc75d-0d04-0410-961f-82ee72b054a4
|
|
|
|
+---
|
|
|
|
+ gcc/ubsan.c | 2 +-
|
|
|
|
+ 2 files changed, 5 insertions(+), 1 deletion(-)
|
|
|
|
+
|
|
|
|
+diff --git a/gcc/ubsan.c b/gcc/ubsan.c
|
|
|
|
+index 5cbc98dbabb..d3bd8e3393d 100644
|
|
|
|
+--- a/gcc/ubsan.c
|
|
|
|
++++ b/gcc/ubsan.c
|
|
|
|
+@@ -1469,7 +1469,7 @@ ubsan_use_new_style_p (location_t loc)
|
|
|
|
+
|
|
|
|
+ expanded_location xloc = expand_location (loc);
|
|
|
|
+ if (xloc.file == NULL || strncmp (xloc.file, "\1", 2) == 0
|
|
|
|
+- || xloc.file == '\0' || xloc.file[0] == '\xff'
|
|
|
|
++ || xloc.file[0] == '\0' || xloc.file[0] == '\xff'
|
|
|
|
+ || xloc.file[1] == '\xff')
|
|
|
|
+ return false;
|
|
|
|
+
|
|
|
|
+--
|
|
|
|
+2.13.0
|
|
|
|
+
|