x86 fsp backport #443

rizlik · 2024-04-24T15:17:02Z

port of improvements and bugfix of x86 FSP code
cleaning of qemu x86 fsp scripts and documentation
notes:
last "pure" backport commit is: 09a2c21

(non-complete) list of commits that may have side-effects out of x86 fsp context:

7f4db82

If CPU enter a triple fault, it goes in shutdown mode and the reset vector is invoked again, without a proper PLTRST#. MemoryInit API fails in this case. Check if CPU is in shutdown mode and reset the platform if so.

danielinux

Please remove the tools/x86_fsp, tools/tgl, tools/qemu directories and move them under tools/scripts as we discussed. Adjust paths in the doc accordingly.

it's needed to compute the hash of PCR TPM register

- use sha256 as hashing algo - enable measure_boot and tpm seal

the function relies a non-general delay() function, so move the function in a more target-specific file.

danielinux

Well done, the port seems very clean. Could possibly use more documentation e.g. on the ATA state machine and other internals. Added config options should be covered in docs/

src/x86/ahci.c

tools/tpm/policy_sign.c

danielinux

Thanks for adding the docs. A few minor typos/rewording.

danielinux · 2024-05-07T12:33:38Z

docs/ata_security.md

+
+## Disabling the password
+
+If you need to disable the password, a master password should be already set on the device. Then you can use the following option to compile wolfBoot so that it will disable the password from the drive and panic:


s/option/options

danielinux · 2024-05-07T12:34:55Z

docs/ata_security.md

+If the ATA disk has no password set, the disk will be locked with the password provided at the first boot.
+
+## Unlocking the Disk with a TPM-Sealed Secret
+wolfBoot allows to seal secret safely in the TPM in a way that it can be unsealed only under specific conditions. Please refer to files TPM.md and measured_boot.md for more information. If the option `WOLFBOOT_TPM_SEAL` is enabled and `DISK_LOCK` is enabled, wolfBoot will use a TPM sealed secret as the password to unlock the disk. The following options controls the sealing and unsealing of the secret:


If the options WOLFBOOT_TPM_SEAL and DISK_LOCK are enabled, wolfboot uses

dgarske · 2024-05-09T14:21:42Z

src/stage2_params.c

@@ -0,0 +1,132 @@
+/* stage2_params.h


stage2_params.c

src/x86/gpt.c

dgarske · 2024-05-09T14:27:37Z

test-app/app_x86_fsp_qemu.c

+
+#ifdef PLATFORM_x86_fsp_qemu
+
+#include<printf.h>


Add space. #include <printf.h>

danielinux

looks good now.

rizlik and others added 23 commits April 23, 2024 10:41

kontron: update default config to load wolfboot at 1408 MB

c4e2afd

tpm seal: add define to choose the key id to seal with

b663ebe

user_settings: allow multiples HAVE_ECC* defines

7f4db82

fsp: stage1: init TPM if TPM_VERIFY = 1 or MEASURED_BOOT = 1

c3bf126

tgl: fsp: check CPU shutdown mode

7e7c5f3

If CPU enter a triple fault, it goes in shutdown mode and the reset vector is invoked again, without a proper PLTRST#. MemoryInit API fails in this case. Check if CPU is in shutdown mode and reset the platform if so.

elf: correct newlines

9c0ca1f

tpm: policy_sign: fix: modulo by zero

abee55e

x86_fsp: qemu: make_hd: allow image from env variable

ddd7fb1

x86_fsp: add QEMU test app (ELF 64bit)

84350a9

x86_fsp: qemu: add qemu build and test script

6d6a9c9

Enhance QEMU scripts

371c03e

A few extra minor improvements to scripts

9f314ce

x86: ahci: check get_key_sha256() return code

e434ddb

x86: qemu: improve test_qemu.sh script, add it to github action

bb7d90c

x86: sata: separate sata_unlock_disk() as a separate operation

7247d11

x86: ata: add check on drive number

bc1e40b

x86: fsp: move stage1 to stage2 related function in a separate file

fd457e5

ahci: allow to delete sealed secret on error

97b3bee

test_qemu.sh: support rebuild-only testing

46b3d82

gpt: support partition label

e7a6262

x86_fsp: update qemu script to support GPT labels

84be0dd

x86_fsp: scripts: print output of QEMU during test

fdcb83f

x86: use hlt instruction in panic()

d89b44e

rizlik requested review from danielinux and dgarske April 24, 2024 15:22

rizlik assigned wolfSSL-Bot Apr 24, 2024

rizlik force-pushed the x86_fsp_backport branch from 4c14129 to 8cd363d Compare April 24, 2024 15:32

danielinux requested changes Apr 25, 2024

View reviewed changes

rizlik added 2 commits April 29, 2024 09:53

fsp: stage1: use temporary parameters struct in pre-mem stage

0833c4b

x86: support cpu exceptions

4bbe43e

rizlik added 13 commits April 29, 2024 09:53

x86_fsp: qemu: move fsp qemu script in tools/x86_fsp/qemu folder

ac1465e

x86_fsp: remove unused configuration

4e99075

tools: qemu64-tpm.sh: make TPM optional

db2b538

tools: rename qemu64-tpm.sh in the more general qemu.sh

9410292

config: examples: use ecc256 and sha256 for basic QEMU FSP example

6c5efe2

mk: x86_fsp: stage1: don't remove fsp_s_signature file

cb9decc

it's needed to compute the hash of PCR TPM register

config: examples: kontron vx3060 s2

5331244

- use sha256 as hashing algo - enable measure_boot and tpm seal

x86_fsp: add helper script to compute TPM PCR reg

5fd8094

x86_fsp: tgl: helper script

96654a3

docs: update QEMU FSP targets documentation

2f4abd5

docs: add Kontron VX3060-S2 FSP target

a8cbc61

tools: move tools/x86_fsp in tools/scripts/x86_fsp

943edf9

x86_fsp: test_qemu.sh: allow grep to return error when checking output

53d012f

rizlik force-pushed the x86_fsp_backport branch from 8cd363d to 53d012f Compare April 29, 2024 08:04

rizlik added 2 commits April 29, 2024 10:27

pci: move pcie_retraining_link in boot_x86_fsp

ee4747e

the function relies a non-general delay() function, so move the function in a more target-specific file.

fix: user_settings.h: fix typo in ECC521 defines

a98e74f

rizlik requested a review from danielinux April 30, 2024 08:17

danielinux requested changes May 2, 2024

View reviewed changes

src/x86/ahci.c Show resolved Hide resolved

src/x86/ahci.c Show resolved Hide resolved

tools/tpm/policy_sign.c Show resolved Hide resolved

rizlik added 2 commits May 2, 2024 15:58

ahci: lock the disk if security disabled

843c86b

docs: add ATA security documentation

292e737

rizlik requested a review from danielinux May 2, 2024 14:26

danielinux reviewed May 7, 2024

View reviewed changes

fixup! docs: add ATA security documentation

3ece783

rizlik requested a review from danielinux May 8, 2024 07:40

dgarske requested changes May 9, 2024

View reviewed changes

minor fixes

5dd9fa9

dgarske self-requested a review May 9, 2024 14:43

dgarske approved these changes May 9, 2024

View reviewed changes

danielinux approved these changes May 9, 2024

View reviewed changes

dgarske merged commit 027c684 into master May 9, 2024
87 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

x86 fsp backport #443

x86 fsp backport #443

rizlik commented Apr 24, 2024 •

edited

danielinux left a comment

danielinux left a comment

danielinux left a comment

danielinux May 7, 2024

danielinux May 7, 2024

dgarske May 9, 2024

dgarske May 9, 2024

danielinux left a comment


		## Disabling the password

		If you need to disable the password, a master password should be already set on the device. Then you can use the following option to compile wolfBoot so that it will disable the password from the drive and panic:


		#ifdef PLATFORM_x86_fsp_qemu

		#include<printf.h>

x86 fsp backport #443

x86 fsp backport #443

Conversation

rizlik commented Apr 24, 2024 • edited

danielinux left a comment

Choose a reason for hiding this comment

danielinux left a comment

Choose a reason for hiding this comment

danielinux left a comment

Choose a reason for hiding this comment

danielinux May 7, 2024

Choose a reason for hiding this comment

danielinux May 7, 2024

Choose a reason for hiding this comment

dgarske May 9, 2024

Choose a reason for hiding this comment

dgarske May 9, 2024

Choose a reason for hiding this comment

danielinux left a comment

Choose a reason for hiding this comment

rizlik commented Apr 24, 2024 •

edited