nai_68int6: add wolfBoot target for the NAI 68INT6 (Intel Tiger Lake UP3) OpenVPX SBC

Author: dgarske

arch.mk

@@ -2187,13 +2187,13 @@ ifeq ($(USE_GCC),1)
 endif
 OUTPUT_FLAG?=-o
 
-ifeq ($(filter $(TARGET),x86_fsp_qemu kontron_vx3060_s2),$(TARGET))
+ifeq ($(filter $(TARGET),x86_fsp_qemu kontron_vx3060_s2 nai_68int6),$(TARGET))
   FSP=1
   CFLAGS+=-ffunction-sections -fdata-sections -ffreestanding -nostdlib -static
   # some std libc have headers that bring in extra symbols used in
   # FORTIFY_SOURCE realated checks. Use -U_FORTIFY_SOURCE to avoid that.
   CFLAGS+=-U_FORTIFY_SOURCE
-  ifeq ($(TARGET), kontron_vx3060_s2)
+  ifeq ($(filter $(TARGET),kontron_vx3060_s2 nai_68int6),$(TARGET))
     FSP_TGL=1
     CFLAGS+=-DWOLFBOOT_TGL=1
   endif
@@ -2243,23 +2243,20 @@ ifeq ("${FSP}", "1")
       OBJS += src/image.o
       OBJS += src/keystore.o
       OBJS += src/sig_wolfboot_raw.o
-      ifeq ($(TARGET), kontron_vx3060_s2)
-        OBJS += hal/kontron_vx3060_s2_loader.o
-      endif
       OBJS += $(WOLFCRYPT_OBJS)
       CFLAGS+=-DSTAGE1_AUTH
     endif
 
+    # Generic stage1 loader HAL (stubs); shared by all x86 FSP targets.
+    OBJS += hal/stub_loader.o
+
     CFLAGS += -fno-stack-protector -m32 -fno-PIC -fno-pie -mno-mmx -mno-sse -DDEBUG_UART
     CFLAGS += -DFSP_M_BASE=$(FSP_M_BASE)
     ifeq ($(FSP_TGL), 1)
       OBJS+=src/x86/tgl_fsp.o
       OBJS+=src/ucode0.o
       CFLAGS += -DUCODE0_ADDRESS=$(UCODE0_BASE)
     endif
-    ifeq ($(TARGET),x86_fsp_qemu)
-      OBJS += hal/x86_fsp_qemu_loader.o
-    endif
   else
     # building wolfBoot
     ifeq ($(FSP_TGL), 1)

config/examples/nai_68int6.config

@@ -0,0 +1,100 @@
+# NAI 68INT6 -- 3U OpenVPX SOSA SBC, Intel Core i7-118xGRE (Tiger Lake UP3).
+# Memory is trained by the FSP from the board's own BIOS (the public TGL_IOT
+# FSP does not train it), extracted with tools/scripts/x86_fsp/tgl/nai_extract_fsp.sh.
+# See the NAI 68INT6 section of docs/Targets.md.
+
+ARCH=x86_64
+TARGET=nai_68int6
+WOLFBOOT_SMALL_STACK=0
+
+# ECC P-384 signature, SHA-384 digest (measured boot uses SHA-256 on an
+# SLB9670). See the integrity-algorithm table in docs/Targets.md.
+SIGN=ECC384
+HASH=SHA384
+
+DEBUG=1
+# FSP-M UPD dump over the console before FspMemInit; bring-up aid, off by default.
+DUMP_FSP_UPD=0
+SPMATH=1
+ENCRYPTION=0
+WOLFBOOT_NO_PARTITIONS=1
+# Disk boot: signed kernels in GPT partitions 3/4, Ubuntu root in partition 2.
+# The A/B boot-partition indices are set per target in src/update_disk.c.
+WOLFBOOT_BOOT_DISK=0
+FORCE_32BIT=1
+
+########## Flash layout (measured from the factory descriptor, 32 MB) ##########
+WOLFBOOT_PARTITION_BOOT_ADDRESS=0xff400000
+WOLFBOOT_PARTITION_SWAP_ADDRESS=0x0
+WOLFBOOT_PARTITION_UPDATE_ADDRESS=0x0
+WOLFBOOT_LOAD_BASE=0x58000200
+WOLFBOOT_SECTOR_SIZE?=0x1000
+WOLFBOOT_DATA_ADDRESS=0x1000000
+
+FSP_CONFIG_BASE=0xffe9f800
+FSP_T_BASE=0xfff59000
+FSP_M_BASE=0xfff60000
+
+WOLFBOOT_ORIGIN=0xfff00000
+BOOTLOADER_PARTITION_SIZE=0x600000
+# Inert (read from the flash descriptor, not this value); kept for config parity.
+BIOS_REGION_SIZE=0xc00000
+
+UCODE0_BASE=0xffd90000
+UCODE0_BIN=src/x86/ucode0.bin
+
+FSP_T_BIN=./src/x86/fsp_t.bin
+FSP_M_BIN=./src/x86/fsp_m.bin
+FSP_S_BIN=./src/x86/fsp_s.bin
+FSP_S_UPD_DATA_BIN=./src/x86/fsp_s_upd_data.bin
+# Boot Guard is left to the board owner: supply an ACM and key here to build a
+# Boot-Guard image. Unset, wolfBoot builds and boots without it.
+ACM_BIN=
+FSP_S_LOAD_BASE=0x0FED5F00
+
+POLICY_BASE=0xffaa4000
+KEYSTORE_OFFSET=0x3FE00
+KEYSTORE_STAGE1_OFFSET=0x400
+
+########## Console: LPSS UART2 (PCI 00:19.2), verified on hardware ##########
+X86_UART_NUMBER=2
+X86_UART_BASE=0xFE032000
+X86_UART_REG_WIDTH=4
+X86_UART_MMIO=1
+
+########## PCH / PCI ##########
+PCH_PCR_BASE=0xFD000000
+PCI_ECAM_BASE=0xC0000000
+PCI_USE_ECAM=1
+PCH_HAS_PCR=1
+# Generate ACPI tables so Linux gets the interrupt model and PCI routing.
+ACPI=1
+
+########## Payload: signed 64-bit Linux bzImage ##########
+64BIT=1
+ELF=1
+DEBUG_ELF=0
+MULTIBOOT2=1
+LINUX_PAYLOAD=1
+
+########## Security ##########
+STAGE1_AUTH=1
+WOLFTPM=1
+MEASURED_BOOT=1
+MEASURED_PCR_A=0
+# Measure the verified OS image into PCR4, alongside the firmware in PCR0.
+MEASURED_PCR_OS=4
+WOLFBOOT_UNIVERSAL_KEYSTORE=1
+WOLFBOOT_SKIP_AUTH_CHECK=0
+# BIOS region not write-locked by default; see "BIOS region lock" in docs/Targets.md.
+WOLFBOOT_DONT_LOCK_BIOS=1
+ENABLE_DEBUG_CONSENT=0
+
+# Deferred: TPM sealing and ATA disk lock/erase.
+WOLFBOOT_TPM_SEAL=0
+DISK_LOCK=0
+DISK_ERASE=0
+
+# Anti-rollback: persistent version floor + audit counters in TPM NV
+# (trust-on-first-use; provision before first boot where that matters).
+ANTI_ROLLBACK=1

docs/Targets.md

@@ -14,6 +14,7 @@ This README describes configuration of supported targets.
 * [Infineon AURIX TC4xx](#infineon-aurix-tc4xx)
 * [Intel x86-64 Intel FSP](#intel-x86_64-with-intel-fsp-support)
 * [Kontron VX3060-S2](#kontron-vx3060-s2)
+* [NAI 68INT6 (Intel Tiger Lake)](#nai-68int6-intel-tiger-lake)
 * [Microchip PIC32CK](#microchip-pic32ck)
 * [Microchip PIC32CZ](#microchip-pic32cz)
 * [Microchip PolarFire SoC](#microchip-polarfire-soc)
@@ -9202,6 +9203,74 @@ Attempting boot from partition A
 ```
 At this point, the kernel image in partition "A" is verified and staged and you should be seeing the log messages of your OS booting.
 
+## NAI 68INT6 (Intel Tiger Lake)
+
+wolfBoot target `nai_68int6` for the North Atlantic Industries 68INT6, a 3U OpenVPX SOSA-aligned single board computer (Intel Core i7-1185GRE, Tiger Lake UP3), using the Intel Firmware Support Package. It shares the Intel FSP support described [above](#intel-x86_64-with-intel-fsp-support) and the Tiger Lake path with the Kontron target. wolfBoot boots a signed 64-bit Linux from the SATA disk with A/B update, measured boot and TPM anti-rollback, verified on a Rev D5 bench board. This board's memory is trained by the FSP from its own BIOS (the public Tiger Lake FSP does not train it), so the FSP set is extracted from a 68INT6 BIOS image rather than downloaded.
+
+| | |
+|---|---|
+| CPU | i7-1185GRE (`06-8C-01`), Tiger Lake UP3, PCH-LP |
+| Memory | 2 x 32 GB DDR4-3200 SODIMM, non-ECC |
+| BIOS flash | Rev C/D5: 2 x W25R256JV (32 MB), jumper-selected (JP36). Next revision: one 64 MB device |
+| TPM | SLB9670 (SHA-1/256), or SLB9672 which adds a SHA-384 bank |
+| Storage | Onboard SATA SSD, AHCI at `00:17.0` |
+| Console | LPSS UART2, PCI `00:19.2`, RS-232; `X86_UART_NUMBER=2` |
+
+### Building
+
+```
+cp config/examples/nai_68int6.config .config
+./tools/scripts/x86_fsp/tgl/tgl_download_fsp.sh              # FSP UPD headers, first time only
+./tools/scripts/x86_fsp/tgl/nai_extract_fsp.sh <68INT6.bin>  # board's own FSP blobs
+./tools/scripts/x86_fsp/tgl/assemble_image.sh -k             # generate signing keys
+make
+./tools/scripts/x86_fsp/tgl/assemble_image.sh -n <68INT6.bin>
+```
+
+`nai_extract_fsp.sh` lifts the FSP-T/M/S and microcode from a real 68INT6 BIOS image; without it the build links against the public FSP, which compiles but will not train this board's memory. The `-n` stitch replaces only the top 6 MB (`BOOTLOADER_PARTITION_SIZE`) of the 12 MB BIOS region and preserves the descriptor and CSME byte for byte. There is no recovery region on Rev C (recovery is the second flash device), so use `-n`, not `-m`. The result is `final_image.bin`.
+
+### Integrity algorithms
+
+ECC P-384 and SHA-384 are chosen to match the algorithms Intel Boot Guard uses to verify the Initial Boot Block, so the wolfBoot chain carries the same strength Boot Guard establishes at reset.
+
+| Layer | Algorithm |
+|---|---|
+| Image signature | ECC P-384 (`SIGN=ECC384`) |
+| Image digest | SHA-384 (`HASH=SHA384`) |
+| Measured boot PCR | SHA-256 (the SLB9670 has only SHA-1 and SHA-256 banks) |
+
+`wolfBoot_image_measure()` re-hashes the authenticated digest with the PCR bank algorithm, so one image serves either TPM. `MEASURED_PCR_ALG=SHA384` needs an SLB9672 with its SHA-384 bank allocated (`TPM2_PCR_Allocate` under platform auth, a provisioning step); with an SLB9670, use SHA-256.
+
+### Configuration
+
+Beyond the flash map and console, the notable options in [config/examples/nai_68int6.config](../config/examples/nai_68int6.config):
+
+| Option | Meaning |
+|---|---|
+| `X86_UART_NUMBER=2` | Selects LPSS UART2 in all three FSP phases (Kontron uses 0) |
+| `ACPI=1` | Generate ACPI tables (RSDP/XSDT/FADT/MADT/MCFG and a minimal DSDT) so Linux gets the interrupt model and PCI routing |
+| `ANTI_ROLLBACK=1` | Persistent version floor plus boot audit counters in TPM NV |
+| `MEASURED_BOOT=1`, `MEASURED_PCR_OS=4` | Measure the firmware into PCR 0 and the verified OS image into PCR 4 |
+| `WOLFBOOT_BOOT_DISK=0` | Boot from GPT disk partitions; the A/B indices (sda3/sda4) are set per target in `src/update_disk.c` |
+
+### BIOS region lock
+
+The BIOS region is not write-locked by default (`WOLFBOOT_DONT_LOCK_BIOS=1`): `hal_flash_lock()` is a stub, so the flash stays writable for in-field updates. For a hardened deployment, call `tgl_lock_bios_region()` (`hal/nai_68int6.c`) from a `hal_flash_protect()` override; it sets the SPI Flash Protected Range 0 and FLOCKDN from the measured BIOS region bounds, read- and write-protecting it until the next platform reset.
+
+### Anti-rollback
+
+`ANTI_ROLLBACK=1` keeps a persistent version floor and a small set of boot audit counters in a TPM NV index, with the backend isolated in `src/boot_state_tpm.c`. The anchor is the highest version ever booted, monotonic and initialised trust-on-first-use; a validly signed but older image still boots and records a rollback audit event; the one condition that halts the boot is a version reference that cannot be trusted. `ANTI_ROLLBACK_STRICT=1` additionally halts when the backend is unreachable or an NV write fails, instead of logging and continuing.
+
+It uses TPM NV rather than the flash-partition state trailer because the floor has to survive a full disk or flash reimage and be tamper-evident, which a trailer in the boot media is not. Disk boot's `DISK_BOOT_CONFIRM` still handles per-slot confirmation; this adds the persistent floor on top, and the backend can later move to a root-of-trust device without touching the policy in `src/boot_state.c`.
+
+The target leaves `ALLOW_DOWNGRADE` unset, the secure default: if the higher-versioned slot fails to verify, wolfBoot does not fall back to a lower-versioned slot but halts (`Rollback to lower version not allowed`). This is deliberate - strict anti-rollback takes precedence over A/B resilience here. A deployment that instead wants a failed slot to fall back across a version decrease can build with `ALLOW_DOWNGRADE=1`, which then leaves the persistent floor in TPM NV as the only rollback guard.
+
+The booted OS cannot lower the floor. wolfBoot write-locks the NV index (`TPMA_NV_WRITE_STCLEAR`) on every boot, before handoff, so it stays read-only until the next TPM reset. `wolfBoot_tpm2_deinit()` then sets the platform hierarchy auth to a random value nobody keeps, as in the TPM keystore build, so the OS cannot undefine the platform-created index and recreate it. Build with `WOLFBOOT_TPM_NO_CHG_PLAT_AUTH` to keep platform auth unchanged.
+
+### Boot, programming and recovery
+
+A/B boot stages a signed 64-bit `bzImage` from the two GPT boot partitions: wolfBoot boots the highest version that verifies, falls back to the other slot when it verifies and is not a downgrade (see Anti-rollback), and holds in reset if neither can be booted. Program the flash with `flashrom` from the board's own Linux, or a Dediprog SF100 on the JP4 header with the board powered off; JP36 selects which bank boots and which a programmer sees, and must only be moved unpowered. The bank the board boots is the only one software can reprogram, so a development image that never reaches an OS is recovered externally with the SF100.
+
 ## Infineon PSOC Control C3
 
 The [PSOC Control C3](https://www.infineon.com/products/microcontroller/32-bit-psoc-arm-cortex/32-bit-psoc-control-arm-cortex-m33-mcu/psoc-control-c3-main-line) family (PSC3, CAT1B) is an Arm Cortex-M33 motor-control MCU. wolfBoot runs as the first application the BootROM launches, verifies the signed firmware in the BOOT partition and jumps to it.