nai_68int6: add wolfBoot target for the NAI 68INT6 (Intel Tiger Lake UP3) OpenVPX SBC

Author: dgarske

arch.mk

@@ -2187,13 +2187,13 @@ ifeq ($(USE_GCC),1)
 endif
 OUTPUT_FLAG?=-o
 
-ifeq ($(filter $(TARGET),x86_fsp_qemu kontron_vx3060_s2),$(TARGET))
+ifeq ($(filter $(TARGET),x86_fsp_qemu kontron_vx3060_s2 nai_68int6),$(TARGET))
   FSP=1
   CFLAGS+=-ffunction-sections -fdata-sections -ffreestanding -nostdlib -static
   # some std libc have headers that bring in extra symbols used in
   # FORTIFY_SOURCE realated checks. Use -U_FORTIFY_SOURCE to avoid that.
   CFLAGS+=-U_FORTIFY_SOURCE
-  ifeq ($(TARGET), kontron_vx3060_s2)
+  ifeq ($(filter $(TARGET),kontron_vx3060_s2 nai_68int6),$(TARGET))
     FSP_TGL=1
     CFLAGS+=-DWOLFBOOT_TGL=1
   endif
@@ -2243,23 +2243,20 @@ ifeq ("${FSP}", "1")
       OBJS += src/image.o
       OBJS += src/keystore.o
       OBJS += src/sig_wolfboot_raw.o
-      ifeq ($(TARGET), kontron_vx3060_s2)
-        OBJS += hal/kontron_vx3060_s2_loader.o
-      endif
       OBJS += $(WOLFCRYPT_OBJS)
       CFLAGS+=-DSTAGE1_AUTH
     endif
 
+    # Generic stage1 loader HAL (stubs); shared by all x86 FSP targets.
+    OBJS += hal/stub_loader.o
+
     CFLAGS += -fno-stack-protector -m32 -fno-PIC -fno-pie -mno-mmx -mno-sse -DDEBUG_UART
     CFLAGS += -DFSP_M_BASE=$(FSP_M_BASE)
     ifeq ($(FSP_TGL), 1)
       OBJS+=src/x86/tgl_fsp.o
       OBJS+=src/ucode0.o
       CFLAGS += -DUCODE0_ADDRESS=$(UCODE0_BASE)
     endif
-    ifeq ($(TARGET),x86_fsp_qemu)
-      OBJS += hal/x86_fsp_qemu_loader.o
-    endif
   else
     # building wolfBoot
     ifeq ($(FSP_TGL), 1)

config/examples/nai_68int6.config

@@ -0,0 +1,100 @@
+# NAI 68INT6 -- 3U OpenVPX SOSA SBC, Intel Core i7-118xGRE (Tiger Lake UP3).
+# Memory is trained by the FSP from the board's own BIOS (the public TGL_IOT
+# FSP does not train it), extracted with tools/scripts/x86_fsp/tgl/nai_extract_fsp.sh.
+# See the NAI 68INT6 section of docs/Targets.md.
+
+ARCH=x86_64
+TARGET=nai_68int6
+WOLFBOOT_SMALL_STACK=0
+
+# ECC P-384 signature, SHA-384 digest (measured boot uses SHA-256 on an
+# SLB9670). See the integrity-algorithm table in docs/Targets.md.
+SIGN=ECC384
+HASH=SHA384
+
+DEBUG=1
+# FSP-M UPD dump over the console before FspMemInit; bring-up aid, off by default.
+DUMP_FSP_UPD=0
+SPMATH=1
+ENCRYPTION=0
+WOLFBOOT_NO_PARTITIONS=1
+# Disk boot: signed kernels in GPT partitions 3/4, Ubuntu root in partition 2.
+# The A/B boot-partition indices are set per target in src/update_disk.c.
+WOLFBOOT_BOOT_DISK=0
+FORCE_32BIT=1
+
+########## Flash layout (measured from the factory descriptor, 32 MB) ##########
+WOLFBOOT_PARTITION_BOOT_ADDRESS=0xff400000
+WOLFBOOT_PARTITION_SWAP_ADDRESS=0x0
+WOLFBOOT_PARTITION_UPDATE_ADDRESS=0x0
+WOLFBOOT_LOAD_BASE=0x58000200
+WOLFBOOT_SECTOR_SIZE?=0x1000
+WOLFBOOT_DATA_ADDRESS=0x1000000
+
+FSP_CONFIG_BASE=0xffe9f800
+FSP_T_BASE=0xfff59000
+FSP_M_BASE=0xfff60000
+
+WOLFBOOT_ORIGIN=0xfff00000
+BOOTLOADER_PARTITION_SIZE=0x600000
+# Inert (read from the flash descriptor, not this value); kept for config parity.
+BIOS_REGION_SIZE=0xc00000
+
+UCODE0_BASE=0xffd90000
+UCODE0_BIN=src/x86/ucode0.bin
+
+FSP_T_BIN=./src/x86/fsp_t.bin
+FSP_M_BIN=./src/x86/fsp_m.bin
+FSP_S_BIN=./src/x86/fsp_s.bin
+FSP_S_UPD_DATA_BIN=./src/x86/fsp_s_upd_data.bin
+# Boot Guard is left to the board owner: supply an ACM and key here to build a
+# Boot-Guard image. Unset, wolfBoot builds and boots without it.
+ACM_BIN=
+FSP_S_LOAD_BASE=0x0FED5F00
+
+POLICY_BASE=0xffaa4000
+KEYSTORE_OFFSET=0x3FE00
+KEYSTORE_STAGE1_OFFSET=0x400
+
+########## Console: LPSS UART2 (PCI 00:19.2), verified on hardware ##########
+X86_UART_NUMBER=2
+X86_UART_BASE=0xFE032000
+X86_UART_REG_WIDTH=4
+X86_UART_MMIO=1
+
+########## PCH / PCI ##########
+PCH_PCR_BASE=0xFD000000
+PCI_ECAM_BASE=0xC0000000
+PCI_USE_ECAM=1
+PCH_HAS_PCR=1
+# Generate ACPI tables so Linux gets the interrupt model and PCI routing.
+ACPI=1
+
+########## Payload: signed 64-bit Linux bzImage ##########
+64BIT=1
+ELF=1
+DEBUG_ELF=0
+MULTIBOOT2=1
+LINUX_PAYLOAD=1
+
+########## Security ##########
+STAGE1_AUTH=1
+WOLFTPM=1
+MEASURED_BOOT=1
+MEASURED_PCR_A=0
+# Measure the verified OS image into PCR4, alongside the firmware in PCR0.
+MEASURED_PCR_OS=4
+WOLFBOOT_UNIVERSAL_KEYSTORE=1
+WOLFBOOT_SKIP_AUTH_CHECK=0
+# BIOS region not write-locked by default; see "BIOS region lock" in docs/Targets.md.
+WOLFBOOT_DONT_LOCK_BIOS=1
+ENABLE_DEBUG_CONSENT=0
+
+# Deferred: TPM sealing and ATA disk lock/erase.
+WOLFBOOT_TPM_SEAL=0
+DISK_LOCK=0
+DISK_ERASE=0
+
+# Anti-rollback: persistent version floor + audit counters in TPM NV
+# (trust-on-first-use; provision before first boot where that matters).
+ANTI_ROLLBACK=1

docs/Targets.md

@@ -14,6 +14,7 @@ This README describes configuration of supported targets.
 * [Infineon AURIX TC4xx](#infineon-aurix-tc4xx)
 * [Intel x86-64 Intel FSP](#intel-x86_64-with-intel-fsp-support)
 * [Kontron VX3060-S2](#kontron-vx3060-s2)
+* [NAI 68INT6 (Intel Tiger Lake)](#nai-68int6-intel-tiger-lake)
 * [Microchip PIC32CK](#microchip-pic32ck)
 * [Microchip PIC32CZ](#microchip-pic32cz)
 * [Microchip PolarFire SoC](#microchip-polarfire-soc)
@@ -9352,6 +9353,74 @@ Attempting boot from partition A
 ```
 At this point, the kernel image in partition "A" is verified and staged and you should be seeing the log messages of your OS booting.
 
+## NAI 68INT6 (Intel Tiger Lake)
+
+wolfBoot target `nai_68int6` for the North Atlantic Industries 68INT6, a 3U OpenVPX SOSA-aligned single board computer (Intel Core i7-1185GRE, Tiger Lake UP3). It uses the Intel FSP support described [above](#intel-x86_64-with-intel-fsp-support) and shares the Tiger Lake path with the Kontron target. wolfBoot boots a signed 64-bit Linux from the SATA disk with A/B update, measured boot and TPM anti-rollback, verified on a Rev D5 bench board. The public Tiger Lake FSP does not train this board's memory, so the FSP is extracted from a 68INT6 BIOS image.
+
+| | |
+|---|---|
+| CPU | i7-1185GRE (`06-8C-01`), Tiger Lake UP3, PCH-LP |
+| Memory | 2 x 32 GB DDR4-3200 SODIMM, non-ECC |
+| BIOS flash | Rev C/D5: 2 x W25R256JV (32 MB), selected by JP36. Next revision: one 64 MB device |
+| TPM | SLB9670 (SHA-1/256), or SLB9672, which adds a SHA-384 bank |
+| Storage | Onboard SATA SSD, AHCI at `00:17.0` |
+| Console | LPSS UART2, PCI `00:19.2`, RS-232; `X86_UART_NUMBER=2` |
+
+### Building
+
+```
+cp config/examples/nai_68int6.config .config
+./tools/scripts/x86_fsp/tgl/tgl_download_fsp.sh              # FSP UPD headers, first time only
+./tools/scripts/x86_fsp/tgl/nai_extract_fsp.sh <68INT6.bin>  # board's own FSP blobs
+./tools/scripts/x86_fsp/tgl/assemble_image.sh -k             # generate signing keys
+make
+./tools/scripts/x86_fsp/tgl/assemble_image.sh -n <68INT6.bin>
+```
+
+`nai_extract_fsp.sh` takes FSP-T/M/S and the microcode from a 68INT6 BIOS image. Without it the build uses the public FSP, which compiles but does not train memory. The `-n` stitch replaces the top 6 MB (`BOOTLOADER_PARTITION_SIZE`) of the 12 MB BIOS region and keeps the descriptor and CSME byte for byte. The board has no recovery region (recovery is the second flash device), so use `-n`, not `-m`. The result is `final_image.bin`.
+
+### Integrity algorithms
+
+ECC P-384 and SHA-384 match what Intel Boot Guard uses for the Initial Boot Block.
+
+| Layer | Algorithm |
+|---|---|
+| Image signature | ECC P-384 (`SIGN=ECC384`) |
+| Image digest | SHA-384 (`HASH=SHA384`) |
+| Measured boot PCR | SHA-256 (the SLB9670 has only SHA-1 and SHA-256 banks) |
+
+`wolfBoot_image_measure()` re-hashes the authenticated digest with the PCR bank's algorithm, so one image serves either TPM. `MEASURED_PCR_ALG=SHA384` needs an SLB9672 with its SHA-384 bank allocated (`TPM2_PCR_Allocate` under platform auth, a provisioning step).
+
+### Configuration
+
+Notable options in [config/examples/nai_68int6.config](../config/examples/nai_68int6.config):
+
+| Option | Meaning |
+|---|---|
+| `X86_UART_NUMBER=2` | LPSS UART2 for all three FSP phases (Kontron uses 0) |
+| `ACPI=1` | Generate ACPI tables (RSDP/XSDT/FADT/MADT/MCFG and a minimal DSDT) for Linux |
+| `ANTI_ROLLBACK=1` | Persistent version floor and boot audit counters in TPM NV |
+| `MEASURED_BOOT=1`, `MEASURED_PCR_OS=4` | Firmware into PCR 0, the verified OS image into PCR 4 |
+| `WOLFBOOT_BOOT_DISK=0` | Boot from GPT partitions; the A/B indices (sda3/sda4) are set in `src/update_disk.c` |
+
+### BIOS region lock
+
+The BIOS region is not write-locked by default (`WOLFBOOT_DONT_LOCK_BIOS=1`), so the flash stays writable for in-field updates. To lock it, call `tgl_lock_bios_region()` (`hal/nai_68int6.c`) from a `hal_flash_protect()` override. It sets SPI Flash Protected Range 0 over the BIOS region and then FLOCKDN, which hold until the next platform reset.
+
+### Anti-rollback
+
+`ANTI_ROLLBACK=1` keeps a version floor and boot audit counters in a TPM NV index; the backend is `src/boot_state_tpm.c` and the policy is `src/boot_state.c`. The floor is the highest version ever booted, set trust-on-first-use. A validly signed older image still boots and records a rollback event. Only an untrustworthy reference halts the boot; `ANTI_ROLLBACK_STRICT=1` also halts when the TPM is unreachable or a write fails.
+
+TPM NV is used instead of the partition state trailer because the floor must survive a full reimage of the disk or flash. `DISK_BOOT_CONFIRM` still handles per-slot confirmation, and the backend can move to a root-of-trust device later without changing the policy.
+
+`ALLOW_DOWNGRADE` is left unset, the secure default: if the higher-versioned slot fails to verify, wolfBoot halts (`Rollback to lower version not allowed`) rather than boot the lower one. Building with `ALLOW_DOWNGRADE=1` allows that fall-back and leaves the TPM floor as the only rollback guard.
+
+The booted OS cannot lower the floor. wolfBoot write-locks the NV index (`TPMA_NV_WRITE_STCLEAR`) on every boot, so it stays read-only until the next TPM reset. `wolfBoot_tpm2_deinit()` then sets the platform hierarchy auth to a random value nobody keeps, as in the TPM keystore build, so the OS cannot undefine the index and recreate it. `WOLFBOOT_TPM_NO_CHG_PLAT_AUTH` keeps platform auth unchanged.
+
+### Boot, programming and recovery
+
+wolfBoot boots the highest-versioned signed 64-bit `bzImage` that verifies from the two GPT boot partitions. It falls back to the other slot only if that is not a downgrade (see Anti-rollback), and holds in reset if neither boots. Program the flash with `flashrom` from the board's Linux, or with a Dediprog SF100 on JP4 while the board is off. JP36 selects which bank boots and which one a programmer sees; move it only with the board off. Software can only reprogram the bank the board booted from, so a development image that never reaches an OS has to be recovered with the SF100.
+
 ## Infineon PSOC Control C3
 
 The [PSOC Control C3](https://www.infineon.com/products/microcontroller/32-bit-psoc-arm-cortex/32-bit-psoc-control-arm-cortex-m33-mcu/psoc-control-c3-main-line) family (PSC3, CAT1B) is an Arm Cortex-M33 motor-control MCU. wolfBoot runs as the first application the BootROM launches, verifies the signed firmware in the BOOT partition and jumps to it.