<p>Philipp Deppenwiese has uploaded this change for <strong>review</strong>.</p><p><a href="https://review.coreboot.org/23873">View Change</a></p><pre style="font-family: monospace,monospace; white-space: pre-wrap;">security/vboot: Make vboot first class citizen<br><br>* Add selection of vboot partition layout,<br>* Add auto generation for vboot flashmap layouts.<br><br>Change-Id: If1ac6db16647eba4ddb28b74d1e0501224c841df<br>Signed-off-by: Philipp Deppenwiese <zaolin@das-labor.org><br>---<br>M Makefile.inc<br>M src/security/vboot/Kconfig<br>M src/security/vboot/Makefile.inc<br>3 files changed, 73 insertions(+), 1 deletion(-)<br><br></pre><pre style="font-family: monospace,monospace; white-space: pre-wrap;">git pull ssh://review.coreboot.org:29418/coreboot refs/changes/73/23873/1</pre><pre style="font-family: monospace,monospace; white-space: pre-wrap;"><span>diff --git a/Makefile.inc b/Makefile.inc</span><br><span>index ca157a2..28b9b48 100644</span><br><span>--- a/Makefile.inc</span><br><span>+++ b/Makefile.inc</span><br><span>@@ -766,7 +766,19 @@</span><br><span> # For a description of the flash layout described by these variables, check</span><br><span> # the $(DEFAULT_FLASHMAP) .fmd files.</span><br><span> ifeq ($(CONFIG_ARCH_X86),y)</span><br><span style="color: hsl(120, 100%, 40%);">+ifeq ($(CONFIG_VBOOT),)</span><br><span> DEFAULT_FLASHMAP:=$(top)/util/cbfstool/default-x86.fmd</span><br><span style="color: hsl(120, 100%, 40%);">+else</span><br><span style="color: hsl(120, 100%, 40%);">+ifeq ($(CONFIG_VBOOT_SAFETY_AB),y)</span><br><span style="color: hsl(120, 100%, 40%);">+DEFAULT_FLASHMAP:=$(top)/util/cbfstool/default-x86-ro-a-b.fmd</span><br><span style="color: hsl(120, 100%, 40%);">+endif</span><br><span style="color: hsl(120, 100%, 40%);">+ifeq ($(CONFIG_VBOOT_SAFETY_A),y)</span><br><span style="color: hsl(120, 100%, 40%);">+DEFAULT_FLASHMAP:=$(top)/util/cbfstool/default-x86-ro-a.fmd</span><br><span style="color: hsl(120, 100%, 40%);">+endif</span><br><span style="color: hsl(120, 100%, 40%);">+ifeq ($(CONFIG_VBOOT_NO_SAFETY),y)</span><br><span style="color: hsl(120, 100%, 40%);">+DEFAULT_FLASHMAP:=$(top)/util/cbfstool/default-x86-ro.fmd</span><br><span style="color: hsl(120, 100%, 40%);">+endif</span><br><span style="color: hsl(120, 100%, 40%);">+endif</span><br><span> # entire flash</span><br><span> FMAP_ROM_ADDR := $(call int-subtract, 0x100000000 $(CONFIG_ROM_SIZE))</span><br><span> FMAP_ROM_SIZE := $(CONFIG_ROM_SIZE)</span><br><span>@@ -791,7 +803,19 @@</span><br><span> FMAP_CBFS_BASE := $(call int-add, $(FMAP_CONSOLE_SIZE) $(FMAP_FMAP_SIZE))</span><br><span> FMAP_CBFS_SIZE := $(call int-subtract, $(FMAP_BIOS_SIZE) $(FMAP_CBFS_BASE))</span><br><span> else # ifeq ($(CONFIG_ARCH_X86),y)</span><br><span style="color: hsl(120, 100%, 40%);">+ifeq ($(CONFIG_VBOOT),)</span><br><span> DEFAULT_FLASHMAP:=$(top)/util/cbfstool/default.fmd</span><br><span style="color: hsl(120, 100%, 40%);">+else</span><br><span style="color: hsl(120, 100%, 40%);">+ifeq ($(CONFIG_VBOOT_SAFETY_AB),y)</span><br><span style="color: hsl(120, 100%, 40%);">+DEFAULT_FLASHMAP:=$(top)/util/cbfstool/default-ro-a-b.fmd</span><br><span style="color: hsl(120, 100%, 40%);">+endif</span><br><span style="color: hsl(120, 100%, 40%);">+ifeq ($(CONFIG_VBOOT_SAFETY_A),y)</span><br><span style="color: hsl(120, 100%, 40%);">+DEFAULT_FLASHMAP:=$(top)/util/cbfstool/default-ro-a.fmd</span><br><span style="color: hsl(120, 100%, 40%);">+endif</span><br><span style="color: hsl(120, 100%, 40%);">+ifeq ($(CONFIG_VBOOT_NO_SAFETY),y)</span><br><span style="color: hsl(120, 100%, 40%);">+DEFAULT_FLASHMAP:=$(top)/util/cbfstool/default-ro.fmd</span><br><span style="color: hsl(120, 100%, 40%);">+endif</span><br><span style="color: hsl(120, 100%, 40%);">+endif</span><br><span> # entire flash</span><br><span> FMAP_ROM_ADDR := 0</span><br><span> FMAP_ROM_SIZE := $(CONFIG_ROM_SIZE)</span><br><span>diff --git a/src/security/vboot/Kconfig b/src/security/vboot/Kconfig</span><br><span>index b92aa24..4373883 100644</span><br><span>--- a/src/security/vboot/Kconfig</span><br><span>+++ b/src/security/vboot/Kconfig</span><br><span>@@ -28,6 +28,24 @@</span><br><span> </span><br><span> choice</span><br><span> </span><br><span style="color: hsl(120, 100%, 40%);">+prompt "Failure safety"</span><br><span style="color: hsl(120, 100%, 40%);">+ default VBOOT_SAFETY_AB</span><br><span style="color: hsl(120, 100%, 40%);">+ help</span><br><span style="color: hsl(120, 100%, 40%);">+ Select the boot mode in which VBOOT should run.</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+config VBOOT_SAFETY_AB</span><br><span style="color: hsl(120, 100%, 40%);">+ bool "Firmware A & B"</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+config VBOOT_SAFETY_A</span><br><span style="color: hsl(120, 100%, 40%);">+ bool "Firmware A"</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+config VBOOT_NO_SAFETY</span><br><span style="color: hsl(120, 100%, 40%);">+ bool "Firmware RO only"</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+endchoice</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+choice</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span> prompt "Boot mode"</span><br><span> default VBOOT_MODE_VERIFIED_BOOT</span><br><span> help</span><br><span>diff --git a/src/security/vboot/Makefile.inc b/src/security/vboot/Makefile.inc</span><br><span>index 8709f5a..2887cb4 100644</span><br><span>--- a/src/security/vboot/Makefile.inc</span><br><span>+++ b/src/security/vboot/Makefile.inc</span><br><span>@@ -152,6 +152,19 @@</span><br><span> endif</span><br><span> endif # CONFIG_VBOOT_SEPARATE_VERSTAGE</span><br><span> </span><br><span style="color: hsl(120, 100%, 40%);">+# Check safety mode</span><br><span style="color: hsl(120, 100%, 40%);">+ifeq ($(CONFIG_VBOOT_SAFETY_AB),y)</span><br><span style="color: hsl(120, 100%, 40%);">+VBOOT_PARTITIONS := COREBOOT FW_MAIN_A FW_MAIN_B</span><br><span style="color: hsl(120, 100%, 40%);">+endif</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ifeq ($(CONFIG_VBOOT_SAFETY_A),y)</span><br><span style="color: hsl(120, 100%, 40%);">+VBOOT_PARTITIONS := COREBOOT FW_MAIN_A</span><br><span style="color: hsl(120, 100%, 40%);">+endif</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ifeq ($(CONFIG_VBOOT_NO_SAFETY),y)</span><br><span style="color: hsl(120, 100%, 40%);">+VBOOT_PARTITIONS := COREBOOT</span><br><span style="color: hsl(120, 100%, 40%);">+endif</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span> # Define a list of files that need to be in RO only.</span><br><span> # All other files will be installed into RO and RW regions</span><br><span> # Use $(sort) to cut down on extra spaces that would be translated to commas</span><br><span>@@ -167,7 +180,7 @@</span><br><span> vbgfx.bin \</span><br><span> rmu.bin \</span><br><span> $(call strip_quotes,$(CONFIG_RO_REGION_ONLY)) \</span><br><span style="color: hsl(0, 100%, 40%);">- ,$(1)),COREBOOT,COREBOOT FW_MAIN_A FW_MAIN_B)))</span><br><span style="color: hsl(120, 100%, 40%);">+ ,$(1)),COREBOOT,$(VBOOT_PARTITIONS))))</span><br><span> </span><br><span> CONFIG_GBB_HWID := $(call strip_quotes,$(CONFIG_GBB_HWID))</span><br><span> CONFIG_GBB_BMPFV_FILE := $(call strip_quotes,$(CONFIG_GBB_BMPFV_FILE))</span><br><span>@@ -237,8 +250,13 @@</span><br><span> @printf " WRITE GBB\n"</span><br><span> $(CBFSTOOL) $(obj)/coreboot.rom write -u -r GBB -i 0 -f $(obj)/gbb.region</span><br><span> $(CBFSTOOL) $(obj)/coreboot.rom write -u -r RO_FRID -i 0 -f $(obj)/fwid.region</span><br><span style="color: hsl(120, 100%, 40%);">+ifeq ($(CONFIG_VBOOT_SAFETY_AB),y)</span><br><span> $(CBFSTOOL) $(obj)/coreboot.rom write -u -r RW_FWID_A -i 0 -f $(obj)/fwid.region</span><br><span> $(CBFSTOOL) $(obj)/coreboot.rom write -u -r RW_FWID_B -i 0 -f $(obj)/fwid.region</span><br><span style="color: hsl(120, 100%, 40%);">+endif</span><br><span style="color: hsl(120, 100%, 40%);">+ifeq ($(CONFIG_VBOOT_SAFETY_A),y)</span><br><span style="color: hsl(120, 100%, 40%);">+ $(CBFSTOOL) $(obj)/coreboot.rom write -u -r RW_FWID_A -i 0 -f $(obj)/fwid.region</span><br><span style="color: hsl(120, 100%, 40%);">+endif</span><br><span> </span><br><span> ifneq ($(shell grep "SHARED_DATA" "$(CONFIG_FMDFILE)"),)</span><br><span> build_complete::</span><br><span>@@ -270,8 +288,20 @@</span><br><span> --kernelkey "$(CONFIG_VBOOT_KERNEL_KEY)" \</span><br><span> --flags $(CONFIG_VBOOT_KEYBLOCK_PREAMBLE_FLAGS)</span><br><span> </span><br><span style="color: hsl(120, 100%, 40%);">+ifeq ($(CONFIG_VBOOT_SAFETY_AB),y)</span><br><span> files_added:: $(obj)/VBLOCK_A.bin $(obj)/VBLOCK_B.bin</span><br><span> $(CBFSTOOL) $(obj)/coreboot.rom write -u -r VBLOCK_A -f $(obj)/VBLOCK_A.bin</span><br><span> $(CBFSTOOL) $(obj)/coreboot.rom write -u -r VBLOCK_B -f $(obj)/VBLOCK_B.bin</span><br><span style="color: hsl(120, 100%, 40%);">+ @printf " FLASHMAP Layout generated for RO, A and B partition.\n"</span><br><span style="color: hsl(120, 100%, 40%);">+endif</span><br><span style="color: hsl(120, 100%, 40%);">+ifeq ($(CONFIG_VBOOT_SAFETY_A),y)</span><br><span style="color: hsl(120, 100%, 40%);">+files_added:: $(obj)/VBLOCK_A.bin</span><br><span style="color: hsl(120, 100%, 40%);">+ $(CBFSTOOL) $(obj)/coreboot.rom write -u -r VBLOCK_A -f $(obj)/VBLOCK_A.bin</span><br><span style="color: hsl(120, 100%, 40%);">+ @printf " FLASHMAP Layout generated for RO and A partition.\n"</span><br><span style="color: hsl(120, 100%, 40%);">+endif</span><br><span style="color: hsl(120, 100%, 40%);">+ifeq ($(CONFIG_VBOOT_NO_SAFETY),y)</span><br><span style="color: hsl(120, 100%, 40%);">+files_added::</span><br><span style="color: hsl(120, 100%, 40%);">+ @printf " FLASHMAP Layout generated for RO partition only, beware no updates possible!\n"</span><br><span style="color: hsl(120, 100%, 40%);">+endif</span><br><span> </span><br><span> endif # CONFIG_VBOOT</span><br><span></span><br></pre><p>To view, visit <a href="https://review.coreboot.org/23873">change 23873</a>. To unsubscribe, or for help writing mail filters, visit <a href="https://review.coreboot.org/settings">settings</a>.</p><div itemscope itemtype="http://schema.org/EmailMessage"><div itemscope itemprop="action" itemtype="http://schema.org/ViewAction"><link itemprop="url" href="https://review.coreboot.org/23873"/><meta itemprop="name" content="View Change"/></div></div>
<div style="display:none"> Gerrit-Project: coreboot </div>
<div style="display:none"> Gerrit-Branch: master </div>
<div style="display:none"> Gerrit-MessageType: newchange </div>
<div style="display:none"> Gerrit-Change-Id: If1ac6db16647eba4ddb28b74d1e0501224c841df </div>
<div style="display:none"> Gerrit-Change-Number: 23873 </div>
<div style="display:none"> Gerrit-PatchSet: 1 </div>
<div style="display:none"> Gerrit-Owner: Philipp Deppenwiese <zaolin.daisuki@gmail.com> </div>