All of the client has already been updated to permit use of multiple
banks, but at most one was ever enabled. TPM 2 log was also updated to
permit handling of multiple digests, but similarly only one was in use.
From now on, it's possible to configure more than one digest (only SHA1
and SHA256 are selected by default). This changes previous TSPI API of
`tpm_log_alg()` (single hash) to `tpm_log_alg_active(enum
vb2_hash_algorithm)` coupled with `enabled_tpm_algs` array (multiple
hashes).
The bulk of the code here is for dealing with the set of banks of TPM:
- querying it from the device to know what digests should be used
- synchronizing set of digests in the log with the actual set of active
banks
The latter is needed in case TPM is initialized in ramstage while
measurements are accumulated starting from the bootblock. An
alternative was to require initializing TPM in the bootblock, but
bootblock may not have enough space for the extra code required for
TPM, hence a different approach was taken: take all supported hashes
before TPM is initialized, trim unnecessary digests after the
initialization.
Change-Id: Ia326b22869c4983fc4e02e150461e7a9ff94dc4e
Upstream-Status: Pending
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
Updates the code to support hashing for more than one digest algorithm
when that's available, the code should work as before at this point.
Change-Id: I6a89d8d430986bda7ee77053ca3768a292e1b53b
Upstream-Status: Pending
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
Updates the code to support hashing for more than one digest algorithm
when that's available, the code should work as before at this point.
Change-Id: I243531e699d927896278df2822e80c69db2715dd
Upstream-Status: Pending
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
Updates the code to support hashing for more than one digest algorithm
when that's available, the code should work as before at this point.
Change-Id: I4e0ea97946e6c8cafbc21a6418b8cb5e7d087df0
Upstream-Status: Pending
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
Get rid of the large if-else statement in
intel_cbnt_inject_ibg_measurements() by moving code from branches into
separate functions.
Upstream-Status: Pending
Change-Id: I892c56d37abac1b43c68ac761d428c3560007246
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
* Update vendor data to drop entry size and maximum count and add offset
to the first unused byte and total number of available bytes. This
bumps its major version because the update breaks compatibility.
* Represent log table as two structures, tpm_2_log_table and
tpm_2_log_bottom, separate by a list of digests in the header.
* Remove tpm_2_log_entry.
* Add functions to store and parse log entries and use them instead of
array operations.
* cbmem tool doesn't need an update because it already parses the log as
an agile format rather than an array of entries of the same size.
Change-Id: I13cebe2a40c220375cc14124ef9b13ea7ee0207f
Upstream-Status: Pending
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
The marshaling code was already there. This change only increases
maximum number of hashes and initializes `tpm2_pcr_extend_cmd` with all
digests that were passed in.
Upstream-Status: Pending
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
No functional changes are intended, merely changing interface and how
places that make use of it. A few places got extra error checks, but
their conditions shouldn't be satisfied at this point.
Upstream-Status: Pending
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
Out of vendorcode/eltan/security/mboot/mboot.c to not duplicate the
implementation.
Upstream-Status: Pending
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
It permits submitting update capsules by putting them in
`/EFI/UpdateCapsule/`, setting the third bit in `OsIndications` EFI
variable and rebooting.
Upstream-Status: Inappropriate [Dasharo downstream]
Change-Id: I04edcd5b7d6944670267bb4dbb0ef4149ffd7bb3
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
This board supports both Intel Boot Guard and capsule updates, not
providing this table results in capsules conservatively assuming the
platform is fused when that's not actually the case.
Change-Id: Ib7db31131c2642f7edeed5f561894ecf6cefd77e
Upstream-Status: Pending
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
EDK requests this boot kind from coreboot in order to discover, load and
process on-disk capsules.
Upstream-Status: Inappropriate [Dasharo downstream]
Change-Id: I2faed8e4f633bac9f475a480887aa2be526cb26d
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
Add a new CBMEM entry that informs payload about current boot. For now,
this is only to indicate that "disk capsules" boot is active and is
needed because in EDK's early stages can't check for EFI variables.
However, it's also nice to have a confirmation from coreboot that it
processed the request.
Change-Id: I6894409542dece959480d7f11784f8c00f069ee7
Upstream-Status: Inappropriate [Dasharo downstream]
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
Changes:
- add handling of Dasharo/"DiskCapsulesBoot" EFI variable which
requests such a boot from coreboot (EDK sets it if OsIndications
requests processing of on-disk capsules and at least one seems to be
present)
- permit HMRFPO during this boot as on-disk capsules are not affected
by cold resets
- act as if FUM is enabled during such a boot because capsules need it
and this way there is no need to ensure several variables are in sync
Upstream-Status: Inappropriate [Dasharo downstream]
Change-Id: I6722fb5ebc5deaa4b2f383f076ee9e3126468ad5
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
This deduplicates and simplifies bodies of several functions.
Upstream-Status: Inappropriate [Dasharo downstream]
Change-Id: I64beb41f8e103f7c7c7accf497e3cb36f0a914c9
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
pre-commit-ci[bot]
Sergii Dmytruk
Wiktor Mowinski
Michał Kopeć