Patrick Georgi (pgeorgi(a)google.com) just uploaded a new patch set to gerrit, which you can find at https://review.coreboot.org/13560
-gerrit
commit 56014787cca7916c5cbdff2637c62b90835a4e4a
Author: Patrick Georgi <pgeorgi(a)chromium.org>
Date: Tue Feb 2 17:52:09 2016 +0100
chromeos: Sign FW_MAIN_A and FW_MAIN_B
This requires payload integration somewhere to be useful, because
without that, adding it will (hopefully) break the signature.
Change-Id: I67b8267e5040e26353df02d258e92a0610e19a52
Signed-off-by: Patrick Georgi <pgeorgi(a)chromium.org>
---
src/vendorcode/google/chromeos/Makefile.inc | 37 +++++++++++++++++++++++++++++
1 file changed, 37 insertions(+)
diff --git a/src/vendorcode/google/chromeos/Makefile.inc b/src/vendorcode/google/chromeos/Makefile.inc
index d686a08..b6d49c2 100644
--- a/src/vendorcode/google/chromeos/Makefile.inc
+++ b/src/vendorcode/google/chromeos/Makefile.inc
@@ -54,6 +54,9 @@ subdirs-$(CONFIG_VBOOT_VERIFY_FIRMWARE) += vboot2
CONFIG_GBB_HWID := $(call strip_quotes,$(CONFIG_GBB_HWID))
CONFIG_GBB_BMPFV_FILE := $(call strip_quotes,$(CONFIG_GBB_BMPFV_FILE))
+CONFIG_VBOOT_KEYBLOCK := $(call strip_quotes,$(CONFIG_VBOOT_KEYBLOCK))
+CONFIG_VBOOT_FIRMWARE_PRIVKEY := $(call strip_quotes,$(CONFIG_VBOOT_FIRMWARE_PRIVKEY))
+CONFIG_VBOOT_KERNEL_KEY := $(call strip_quotes,$(CONFIG_VBOOT_KERNEL_KEY))
# bool-to-mask(var, value)
# return "value" if var is "y", 0 otherwise
@@ -103,3 +106,37 @@ $(obj)/gbb.region: $(obj)/gbb.stub
build_complete:: $(obj)/gbb.region
@printf " WRITE GBB\n"
$(CBFSTOOL) $(obj)/coreboot.rom write -u -r GBB -f $<
+
+# Extract FW_MAIN_? region and minimize it if the last file is empty, so it
+# doesn't contain this empty file (that can have a significant size),
+# improving a lot on hash times due to a smaller amount of data loaded from
+# firmware storage.
+# When passing the minimized image to vbutil_firmware, its length is recorded
+# in the keyblock, and coreboot's vboot code clips the region_device to match,
+# which prevents any potential extension attacks.
+$(obj)/FW_MAIN_%.bin: $(obj)/coreboot.rom
+ $(CBFSTOOL) $< read -r $(basename $(notdir $@)) -f $@.tmp
+ $(CBFSTOOL) $(obj)/coreboot.rom print -k -r $(basename $(notdir $@)) | \
+ tail -1 | \
+ sed "s,^(empty)[[:space:]]\(0x[0-9a-f]*\)\tnull\t.*$$,\1," \
+ > $@.tmp.size
+ if [ -n "$$(cat $@.tmp.size)" ]; then \
+ head -c $$( printf "%d" $$(cat $@.tmp.size)) $@.tmp > $@.tmp2 && \
+ mv $@.tmp2 $@; \
+ else \
+ mv $@.tmp $@; \
+ fi
+
+$(obj)/VBLOCK_%.bin: $(obj)/FW_MAIN_%.bin $(FUTILITY)
+ $(FUTILITY) vbutil_firmware \
+ --vblock $@ \
+ --keyblock "$(CONFIG_VBOOT_KEYBLOCK)" \
+ --signprivate "$(CONFIG_VBOOT_FIRMWARE_PRIVKEY)" \
+ --version $(CONFIG_VBOOT_KEYBLOCK_VERSION) \
+ --fv $< \
+ --kernelkey "$(CONFIG_VBOOT_KERNEL_KEY)" \
+ --flags $(CONFIG_VBOOT_KEYBLOCK_PREAMBLE_FLAGS)
+
+files_added:: $(obj)/VBLOCK_A.bin $(obj)/VBLOCK_B.bin
+ $(CBFSTOOL) $(obj)/coreboot.rom write -u -r VBLOCK_A -f $(obj)/VBLOCK_A.bin
+ $(CBFSTOOL) $(obj)/coreboot.rom write -u -r VBLOCK_B -f $(obj)/VBLOCK_B.bin
Patrick Rudolph (siro(a)das-labor.org) just uploaded a new patch set to gerrit, which you can find at https://review.coreboot.org/11917
-gerrit
commit 63917f8419a26d7e6944a74ffd55d5bbf018434c
Author: Patrick Rudolph <siro(a)das-labor.org>
Date: Thu Oct 15 11:09:15 2015 +0200
nb/intel/sandybridge: Start PEG link training
Issue observed:
The PCIe Root port shows up in GNU/Linux but no PCIe device
is being detected.
Test system:
* Gigabyte GA-B75M-D3H (Intel Pentium CPU G2130)
* Lenovo T530 (Intel Core i5-3320M CPU)
Problem description:
The PEG Root port link training on Ivy Bridge needs to be manually started.
Problem solution:
The bits are set in early_init to meet PCIe reset timeout of 100msec.
The bits should be set in PCI device enable function, but this causes the
PCI enumeration to not detect the card, as it's still booting. Adding
a fixed delay of 100msec resolves this problem, but this would
increase boot time.
Don't run the code on MRC path as it has its own PEG initilization code.
Tested with:
* Nvidia NVS 5400M (PCIe2)
* ATI Radeon HD4780 (PCIe2)
* Nvidia GeForce 8600 GT (PCIe1)
Untested:
* PCIe3 devices
Final test results:
The PEG device shows up under GNU/Linux and can be used without issues.
Change-Id: Id8cfc43e5c4630b0ac217d98bb857c3308e6015b
Signed-off-by: Patrick Rudolph <siro(a)das-labor.org>
---
src/northbridge/intel/sandybridge/early_init.c | 43 ++++++++++++++++++++++++++
1 file changed, 43 insertions(+)
diff --git a/src/northbridge/intel/sandybridge/early_init.c b/src/northbridge/intel/sandybridge/early_init.c
index 81bf9d5..91f1eba 100644
--- a/src/northbridge/intel/sandybridge/early_init.c
+++ b/src/northbridge/intel/sandybridge/early_init.c
@@ -148,6 +148,40 @@ static void sandybridge_setup_graphics(void)
MCHBAR32(0x5418) = reg32;
}
+/* PEG on IvyBridge+ needs a special startup sequence.
+ * As the MRC has its own initialization code skip it.
+ */
+static void start_peg_link_training(void)
+{
+ u32 tmp;
+ u32 deven;
+
+ if (!IS_ENABLED(CONFIG_NORTHBRIDGE_INTEL_IVYBRIDGE))
+ return;
+
+ deven = pci_read_config32(PCI_DEV(0, 0, 0), DEVEN);
+
+ if (deven & DEVEN_PEG10) {
+ tmp = pci_read_config32(PCI_DEV(0, 1, 0), 0xC24) & ~(1 << 16);
+ pci_write_config32(PCI_DEV(0, 1, 0), 0xC24, tmp | (1 << 5));
+ }
+
+ if (deven & DEVEN_PEG11) {
+ tmp = pci_read_config32(PCI_DEV(0, 1, 1), 0xC24) & ~(1 << 16);
+ pci_write_config32(PCI_DEV(0, 1, 1), 0xC24, tmp | (1 << 5));
+ }
+
+ if (deven & DEVEN_PEG12) {
+ tmp = pci_read_config32(PCI_DEV(0, 1, 2), 0xC24) & ~(1 << 16);
+ pci_write_config32(PCI_DEV(0, 1, 2), 0xC24, tmp | (1 << 5));
+ }
+
+ if (deven & DEVEN_PEG60) {
+ tmp = pci_read_config32(PCI_DEV(0, 6, 0), 0xC24) & ~(1 << 16);
+ pci_write_config32(PCI_DEV(0, 6, 0), 0xC24, tmp | (1 << 5));
+ }
+}
+
void sandybridge_early_initialization(int chipset_type)
{
u32 capid0_a;
@@ -177,6 +211,15 @@ void sandybridge_early_initialization(int chipset_type)
pci_write_config32(PCI_DEV(0, 0, 0), DEVEN, deven);
sandybridge_setup_graphics();
+
+ /* Write magic value to start PEG link training.
+ * This should be done in PCI device enumeration, but
+ * the PCIe specification requires to wait at least 100msec
+ * after reset for devices to come up.
+ * As we don't want to increase boot time, enable it early and
+ * assume the PEG is up as soon as PCI enumeration starts.
+ * TODO: use time stamps to ensure the timings are met */
+ start_peg_link_training();
}
void northbridge_romstage_finalize(int s3resume)
the following patch was just integrated into master:
commit 3df9262b096fe2284a7d91f09b7b410df0359a46
Author: Patrick Georgi <pgeorgi(a)chromium.org>
Date: Tue Feb 2 19:33:00 2016 +0100
crossgcc: Bring back the old iasl building scheme
This makes the cross{gcc,tools}-* targets build iasl again, without
building it many times for cross{gcc,tools}
Change-Id: I7546c2af5f7cce3a4f1a08f593fb5cbc675d69ad
Signed-off-by: Patrick Georgi <pgeorgi(a)chromium.org>
Reviewed-on: https://review.coreboot.org/13564
Tested-by: build bot (Jenkins)
Reviewed-by: Martin Roth <martinroth(a)google.com>
See https://review.coreboot.org/13564 for details.
-gerrit
Patrick Georgi (pgeorgi(a)google.com) just uploaded a new patch set to gerrit, which you can find at https://review.coreboot.org/13560
-gerrit
commit 522f2b2d3984f22f42d37e49015f91f635116a51
Author: Patrick Georgi <pgeorgi(a)chromium.org>
Date: Tue Feb 2 17:52:09 2016 +0100
chromeos: Sign FW_MAIN_A and FW_MAIN_B
This requires payload integration somewhere to be useful, because
without that, adding it will (hopefully) break the signature.
Change-Id: I67b8267e5040e26353df02d258e92a0610e19a52
Signed-off-by: Patrick Georgi <pgeorgi(a)chromium.org>
---
src/vendorcode/google/chromeos/Makefile.inc | 37 +++++++++++++++++++++++++++++
1 file changed, 37 insertions(+)
diff --git a/src/vendorcode/google/chromeos/Makefile.inc b/src/vendorcode/google/chromeos/Makefile.inc
index d686a08..3182d6e 100644
--- a/src/vendorcode/google/chromeos/Makefile.inc
+++ b/src/vendorcode/google/chromeos/Makefile.inc
@@ -54,6 +54,9 @@ subdirs-$(CONFIG_VBOOT_VERIFY_FIRMWARE) += vboot2
CONFIG_GBB_HWID := $(call strip_quotes,$(CONFIG_GBB_HWID))
CONFIG_GBB_BMPFV_FILE := $(call strip_quotes,$(CONFIG_GBB_BMPFV_FILE))
+CONFIG_VBOOT_KEYBLOCK := $(call strip_quotes,$(CONFIG_VBOOT_KEYBLOCK))
+CONFIG_VBOOT_FIRMWARE_PRIVKEY := $(call strip_quotes,$(CONFIG_VBOOT_FIRMWARE_PRIVKEY))
+CONFIG_VBOOT_KERNEL_KEY := $(call strip_quotes,$(CONFIG_VBOOT_KERNEL_KEY))
# bool-to-mask(var, value)
# return "value" if var is "y", 0 otherwise
@@ -103,3 +106,37 @@ $(obj)/gbb.region: $(obj)/gbb.stub
build_complete:: $(obj)/gbb.region
@printf " WRITE GBB\n"
$(CBFSTOOL) $(obj)/coreboot.rom write -u -r GBB -f $<
+
+# Extract FW_MAIN_? region and minimize it if the last file is empty, so it
+# doesn't contain this empty file (that can have a significant size),
+# improving a lot on hash times due to a smaller amount of data loaded from
+# firmware storage.
+# When passing the minimized image to vbutil_firmware, its length is recorded
+# in the keyblock, and coreboot's vboot code clips the region_device to match,
+# which prevents any potential extension attacks.
+$(obj)/FW_MAIN_%.bin: $(obj)/coreboot.rom
+ $(CBFSTOOL) $< read -r $(basename $(notdir $@)) -f $@.tmp
+ $(CBFSTOOL) $(obj)/coreboot.rom print -k -r $(basename $(notdir $@)) | \
+ tail -1 | \
+ sed "s,^(empty)[[:space:]]\(0x[0-9a-f]*\)\tnull\t.*$$,\1," \
+ > $@.tmp.size
+ if [ -n "`cat $@.tmp.size`" ]; then \
+ head -c $$( printf "%d" $$(cat $@.tmp.size)) $@.tmp > $@.tmp2 && \
+ mv $@.tmp2 $@; \
+ else \
+ mv $@.tmp $@; \
+ fi
+
+$(obj)/VBLOCK_%.bin: $(obj)/FW_MAIN_%.bin $(FUTILITY)
+ $(FUTILITY) vbutil_firmware \
+ --vblock $@ \
+ --keyblock "$(CONFIG_VBOOT_KEYBLOCK)" \
+ --signprivate "$(CONFIG_VBOOT_FIRMWARE_PRIVKEY)" \
+ --version $(CONFIG_VBOOT_KEYBLOCK_VERSION) \
+ --fv $< \
+ --kernelkey "$(CONFIG_VBOOT_KERNEL_KEY)" \
+ --flags $(CONFIG_VBOOT_KEYBLOCK_PREAMBLE_FLAGS)
+
+files_added:: $(obj)/VBLOCK_A.bin $(obj)/VBLOCK_B.bin
+ $(CBFSTOOL) $(obj)/coreboot.rom write -u -r VBLOCK_A -f $(obj)/VBLOCK_A.bin
+ $(CBFSTOOL) $(obj)/coreboot.rom write -u -r VBLOCK_B -f $(obj)/VBLOCK_B.bin
Leroy P Leahy (leroy.p.leahy(a)intel.com) just uploaded a new patch set to gerrit, which you can find at https://review.coreboot.org/13591
-gerrit
commit 8f945d7a59989cbcd759634914b6a154a8766b26
Author: Lee Leahy <leroy.p.leahy(a)intel.com>
Date: Wed Feb 3 10:13:57 2016 -0800
lib: Support UNCOMPRESSED_RAMSTAGE
Selecting UNCOMPRESSED_RAMSTAGE prevents lzma.c from being compiled for
romstage. Adjust the logic in rmodule.c to prevent calls to the ulzma
routine when UNCOMPRESSED_RAMSTAGE is selected.
TEST=Build and run on Galileo
Change-Id: I7409e082baab3c2a086c57ad5aa9844ba788c7cd
Signed-off-by: Lee Leahy <leroy.p.leahy(a)intel.com>
---
src/lib/rmodule.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/lib/rmodule.c b/src/lib/rmodule.c
index 84b8734..cf8c200 100644
--- a/src/lib/rmodule.c
+++ b/src/lib/rmodule.c
@@ -286,7 +286,8 @@ int rmodule_stage_load(struct rmod_stage_load *rsl)
if (rdev_readat(fh, rmod_loc, sizeof(stage), stage.len) !=
stage.len)
return -1;
- } else if (stage.compression == CBFS_COMPRESS_LZMA) {
+ } else if ((!ENV_ROMSTAGE || IS_ENABLED(CONFIG_COMPRESS_RAMSTAGE))
+ && (stage.compression == CBFS_COMPRESS_LZMA)) {
size_t fsize;
void *map = rdev_mmap(fh, sizeof(stage), stage.len);
the following patch was just integrated into master:
commit 5ea87ff8610b1ec8d8d2ede80a52f72f9219b2d4
Author: Patrick Georgi <pgeorgi(a)chromium.org>
Date: Tue Feb 2 15:05:57 2016 +0100
chromeos: Add Kconfig options for GBB flags
Use the flags to preset the GBB flags field. The Kconfig defaults are
chosen for a "developer" configuration.
Change-Id: Ifcc05aab10b92a2fc201b663df5ea47f92439a3f
Signed-off-by: Patrick Georgi <pgeorgi(a)chromium.org>
Reviewed-on: https://review.coreboot.org/13559
Tested-by: build bot (Jenkins)
Reviewed-by: Stefan Reinauer <stefan.reinauer(a)coreboot.org>
See https://review.coreboot.org/13559 for details.
-gerrit