February 2018 - coreboot-gerrit

Change in coreboot[master]: security/vboot: Add boot mode selection
by build bot (Jenkins) (Code Review) Feb. 26, 2018

Feb. 26, 2018

build bot (Jenkins) has posted comments on this change. ( https://review.coreboot.org/23756 ) Change subject: security/vboot: Add boot mode selection ...................................................................... Patch Set 21: Verified+1 Build Successful https://qa.coreboot.org/job/coreboot-gerrit/67947/ : SUCCESS https://qa.coreboot.org/job/coreboot-checkpatch/22427/ : SUCCESS -- To view, visit https://review.coreboot.org/23756 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I43d233d5a8766af2dd7f07cc0b64293a80d5d7d2 Gerrit-Change-Number: 23756 Gerrit-PatchSet: 21 Gerrit-Owner: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com> Gerrit-Reviewer: Aaron Durbin <adurbin(a)chromium.org> Gerrit-Reviewer: Paul Menzel <paulepanter(a)users.sourceforge.net> Gerrit-Reviewer: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Mon, 26 Feb 2018 18:40:42 +0000 Gerrit-HasComments: No Gerrit-HasLabels: Yes

1 0

Change in coreboot[master]: security/vboot: Add boot mode selection
by build bot (Jenkins) (Code Review) Feb. 26, 2018

Feb. 26, 2018

build bot (Jenkins) has posted comments on this change. ( https://review.coreboot.org/23756 ) Change subject: security/vboot: Add boot mode selection ...................................................................... Patch Set 20: Verified+1 Build Successful https://qa.coreboot.org/job/coreboot-gerrit/67946/ : SUCCESS https://qa.coreboot.org/job/coreboot-checkpatch/22426/ : SUCCESS -- To view, visit https://review.coreboot.org/23756 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I43d233d5a8766af2dd7f07cc0b64293a80d5d7d2 Gerrit-Change-Number: 23756 Gerrit-PatchSet: 20 Gerrit-Owner: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com> Gerrit-Reviewer: Aaron Durbin <adurbin(a)chromium.org> Gerrit-Reviewer: Paul Menzel <paulepanter(a)users.sourceforge.net> Gerrit-Reviewer: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Mon, 26 Feb 2018 18:33:54 +0000 Gerrit-HasComments: No Gerrit-HasLabels: Yes

1 0

Change in coreboot[master]: security/vboot: Make vboot first class citizen
by build bot (Jenkins) (Code Review) Feb. 26, 2018

Feb. 26, 2018

build bot (Jenkins) has posted comments on this change. ( https://review.coreboot.org/23873 ) Change subject: security/vboot: Make vboot first class citizen ...................................................................... Patch Set 3: Verified+1 Build Successful https://qa.coreboot.org/job/coreboot-gerrit/67945/ : SUCCESS https://qa.coreboot.org/job/coreboot-checkpatch/22425/ : SUCCESS -- To view, visit https://review.coreboot.org/23873 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: If1ac6db16647eba4ddb28b74d1e0501224c841df Gerrit-Change-Number: 23873 Gerrit-PatchSet: 3 Gerrit-Owner: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Mon, 26 Feb 2018 18:26:33 +0000 Gerrit-HasComments: No Gerrit-HasLabels: Yes

1 0

Change in coreboot[master]: security/vboot: Make vboot first class citizen
by build bot (Jenkins) (Code Review) Feb. 26, 2018

Feb. 26, 2018

build bot (Jenkins) has posted comments on this change. ( https://review.coreboot.org/23873 ) Change subject: security/vboot: Make vboot first class citizen ...................................................................... Patch Set 2: Verified-1 Build Failed https://qa.coreboot.org/job/coreboot-gerrit/67944/ : ABORTED https://qa.coreboot.org/job/coreboot-checkpatch/22424/ : SUCCESS -- To view, visit https://review.coreboot.org/23873 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: If1ac6db16647eba4ddb28b74d1e0501224c841df Gerrit-Change-Number: 23873 Gerrit-PatchSet: 2 Gerrit-Owner: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Mon, 26 Feb 2018 18:22:31 +0000 Gerrit-HasComments: No Gerrit-HasLabels: Yes

1 0

Change in coreboot[master]: security/vboot: Make vboot first class citizen
by Philipp Deppenwiese (Code Review) Feb. 26, 2018

Feb. 26, 2018

Hello build bot (Jenkins), I'd like you to reexamine a change. Please visit https://review.coreboot.org/23873 to look at the new patch set (#3). Change subject: security/vboot: Make vboot first class citizen ...................................................................... security/vboot: Make vboot first class citizen * Add selection of vboot partition layout, * Add auto generation for vboot flashmap layouts. * Add measured boot mode which is possible with RO only. Change-Id: If1ac6db16647eba4ddb28b74d1e0501224c841df Signed-off-by: Philipp Deppenwiese <zaolin(a)das-labor.org> --- M Makefile.inc M src/security/vboot/Kconfig M src/security/vboot/Makefile.inc M src/security/vboot/vboot_logic.c 4 files changed, 88 insertions(+), 2 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/73/23873/3 -- To view, visit https://review.coreboot.org/23873 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: newpatchset Gerrit-Change-Id: If1ac6db16647eba4ddb28b74d1e0501224c841df Gerrit-Change-Number: 23873 Gerrit-PatchSet: 3 Gerrit-Owner: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>

1 0

Change in coreboot[master]: security/vboot: Make vboot first class citizen
by Philipp Deppenwiese (Code Review) Feb. 26, 2018

Feb. 26, 2018

Hello build bot (Jenkins), I'd like you to reexamine a change. Please visit https://review.coreboot.org/23873 to look at the new patch set (#2). Change subject: security/vboot: Make vboot first class citizen ...................................................................... security/vboot: Make vboot first class citizen * Add selection of vboot partition layout, * Add auto generation for vboot flashmap layouts. * Add measured boot mode which is possible with RO only. Change-Id: If1ac6db16647eba4ddb28b74d1e0501224c841df Signed-off-by: Philipp Deppenwiese <zaolin(a)das-labor.org> --- M Makefile.inc M src/security/vboot/Kconfig M src/security/vboot/Makefile.inc M src/security/vboot/vboot_logic.c 4 files changed, 88 insertions(+), 2 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/73/23873/2 -- To view, visit https://review.coreboot.org/23873 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: newpatchset Gerrit-Change-Id: If1ac6db16647eba4ddb28b74d1e0501224c841df Gerrit-Change-Number: 23873 Gerrit-PatchSet: 2 Gerrit-Owner: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>

1 0

Change in coreboot[master]: security/vboot: Make vboot first class citizen
by build bot (Jenkins) (Code Review) Feb. 26, 2018

Feb. 26, 2018

build bot (Jenkins) has posted comments on this change. ( https://review.coreboot.org/23873 ) Change subject: security/vboot: Make vboot first class citizen ...................................................................... Patch Set 1: Verified+1 Build Successful https://qa.coreboot.org/job/coreboot-gerrit/67943/ : SUCCESS https://qa.coreboot.org/job/coreboot-checkpatch/22423/ : SUCCESS -- To view, visit https://review.coreboot.org/23873 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: If1ac6db16647eba4ddb28b74d1e0501224c841df Gerrit-Change-Number: 23873 Gerrit-PatchSet: 1 Gerrit-Owner: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Mon, 26 Feb 2018 18:06:02 +0000 Gerrit-HasComments: No Gerrit-HasLabels: Yes

1 0

Change in coreboot[master]: security/vboot: Make vboot first class citizen
by Philipp Deppenwiese (Code Review) Feb. 26, 2018

Feb. 26, 2018

Philipp Deppenwiese has uploaded this change for review. ( https://review.coreboot.org/23873 Change subject: security/vboot: Make vboot first class citizen ...................................................................... security/vboot: Make vboot first class citizen * Add selection of vboot partition layout, * Add auto generation for vboot flashmap layouts. Change-Id: If1ac6db16647eba4ddb28b74d1e0501224c841df Signed-off-by: Philipp Deppenwiese <zaolin(a)das-labor.org> --- M Makefile.inc M src/security/vboot/Kconfig M src/security/vboot/Makefile.inc 3 files changed, 73 insertions(+), 1 deletion(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/73/23873/1 diff --git a/Makefile.inc b/Makefile.inc index ca157a2..28b9b48 100644 --- a/Makefile.inc +++ b/Makefile.inc @@ -766,7 +766,19 @@ # For a description of the flash layout described by these variables, check # the $(DEFAULT_FLASHMAP) .fmd files. ifeq ($(CONFIG_ARCH_X86),y) +ifeq ($(CONFIG_VBOOT),) DEFAULT_FLASHMAP:=$(top)/util/cbfstool/default-x86.fmd +else +ifeq ($(CONFIG_VBOOT_SAFETY_AB),y) +DEFAULT_FLASHMAP:=$(top)/util/cbfstool/default-x86-ro-a-b.fmd +endif +ifeq ($(CONFIG_VBOOT_SAFETY_A),y) +DEFAULT_FLASHMAP:=$(top)/util/cbfstool/default-x86-ro-a.fmd +endif +ifeq ($(CONFIG_VBOOT_NO_SAFETY),y) +DEFAULT_FLASHMAP:=$(top)/util/cbfstool/default-x86-ro.fmd +endif +endif # entire flash FMAP_ROM_ADDR := $(call int-subtract, 0x100000000 $(CONFIG_ROM_SIZE)) FMAP_ROM_SIZE := $(CONFIG_ROM_SIZE) @@ -791,7 +803,19 @@ FMAP_CBFS_BASE := $(call int-add, $(FMAP_CONSOLE_SIZE) $(FMAP_FMAP_SIZE)) FMAP_CBFS_SIZE := $(call int-subtract, $(FMAP_BIOS_SIZE) $(FMAP_CBFS_BASE)) else # ifeq ($(CONFIG_ARCH_X86),y) +ifeq ($(CONFIG_VBOOT),) DEFAULT_FLASHMAP:=$(top)/util/cbfstool/default.fmd +else +ifeq ($(CONFIG_VBOOT_SAFETY_AB),y) +DEFAULT_FLASHMAP:=$(top)/util/cbfstool/default-ro-a-b.fmd +endif +ifeq ($(CONFIG_VBOOT_SAFETY_A),y) +DEFAULT_FLASHMAP:=$(top)/util/cbfstool/default-ro-a.fmd +endif +ifeq ($(CONFIG_VBOOT_NO_SAFETY),y) +DEFAULT_FLASHMAP:=$(top)/util/cbfstool/default-ro.fmd +endif +endif # entire flash FMAP_ROM_ADDR := 0 FMAP_ROM_SIZE := $(CONFIG_ROM_SIZE) diff --git a/src/security/vboot/Kconfig b/src/security/vboot/Kconfig index b92aa24..4373883 100644 --- a/src/security/vboot/Kconfig +++ b/src/security/vboot/Kconfig @@ -28,6 +28,24 @@ choice +prompt "Failure safety" + default VBOOT_SAFETY_AB + help + Select the boot mode in which VBOOT should run. + +config VBOOT_SAFETY_AB + bool "Firmware A & B" + +config VBOOT_SAFETY_A + bool "Firmware A" + +config VBOOT_NO_SAFETY + bool "Firmware RO only" + +endchoice + +choice + prompt "Boot mode" default VBOOT_MODE_VERIFIED_BOOT help diff --git a/src/security/vboot/Makefile.inc b/src/security/vboot/Makefile.inc index 8709f5a..2887cb4 100644 --- a/src/security/vboot/Makefile.inc +++ b/src/security/vboot/Makefile.inc @@ -152,6 +152,19 @@ endif endif # CONFIG_VBOOT_SEPARATE_VERSTAGE +# Check safety mode +ifeq ($(CONFIG_VBOOT_SAFETY_AB),y) +VBOOT_PARTITIONS := COREBOOT FW_MAIN_A FW_MAIN_B +endif + +ifeq ($(CONFIG_VBOOT_SAFETY_A),y) +VBOOT_PARTITIONS := COREBOOT FW_MAIN_A +endif + +ifeq ($(CONFIG_VBOOT_NO_SAFETY),y) +VBOOT_PARTITIONS := COREBOOT +endif + # Define a list of files that need to be in RO only. # All other files will be installed into RO and RW regions # Use $(sort) to cut down on extra spaces that would be translated to commas @@ -167,7 +180,7 @@ vbgfx.bin \ rmu.bin \ $(call strip_quotes,$(CONFIG_RO_REGION_ONLY)) \ - ,$(1)),COREBOOT,COREBOOT FW_MAIN_A FW_MAIN_B))) + ,$(1)),COREBOOT,$(VBOOT_PARTITIONS)))) CONFIG_GBB_HWID := $(call strip_quotes,$(CONFIG_GBB_HWID)) CONFIG_GBB_BMPFV_FILE := $(call strip_quotes,$(CONFIG_GBB_BMPFV_FILE)) @@ -237,8 +250,13 @@ @printf " WRITE GBB\n" $(CBFSTOOL) $(obj)/coreboot.rom write -u -r GBB -i 0 -f $(obj)/gbb.region $(CBFSTOOL) $(obj)/coreboot.rom write -u -r RO_FRID -i 0 -f $(obj)/fwid.region +ifeq ($(CONFIG_VBOOT_SAFETY_AB),y) $(CBFSTOOL) $(obj)/coreboot.rom write -u -r RW_FWID_A -i 0 -f $(obj)/fwid.region $(CBFSTOOL) $(obj)/coreboot.rom write -u -r RW_FWID_B -i 0 -f $(obj)/fwid.region +endif +ifeq ($(CONFIG_VBOOT_SAFETY_A),y) + $(CBFSTOOL) $(obj)/coreboot.rom write -u -r RW_FWID_A -i 0 -f $(obj)/fwid.region +endif ifneq ($(shell grep "SHARED_DATA" "$(CONFIG_FMDFILE)"),) build_complete:: @@ -270,8 +288,20 @@ --kernelkey "$(CONFIG_VBOOT_KERNEL_KEY)" \ --flags $(CONFIG_VBOOT_KEYBLOCK_PREAMBLE_FLAGS) +ifeq ($(CONFIG_VBOOT_SAFETY_AB),y) files_added:: $(obj)/VBLOCK_A.bin $(obj)/VBLOCK_B.bin $(CBFSTOOL) $(obj)/coreboot.rom write -u -r VBLOCK_A -f $(obj)/VBLOCK_A.bin $(CBFSTOOL) $(obj)/coreboot.rom write -u -r VBLOCK_B -f $(obj)/VBLOCK_B.bin + @printf " FLASHMAP Layout generated for RO, A and B partition.\n" +endif +ifeq ($(CONFIG_VBOOT_SAFETY_A),y) +files_added:: $(obj)/VBLOCK_A.bin + $(CBFSTOOL) $(obj)/coreboot.rom write -u -r VBLOCK_A -f $(obj)/VBLOCK_A.bin + @printf " FLASHMAP Layout generated for RO and A partition.\n" +endif +ifeq ($(CONFIG_VBOOT_NO_SAFETY),y) +files_added:: + @printf " FLASHMAP Layout generated for RO partition only, beware no updates possible!\n" +endif endif # CONFIG_VBOOT -- To view, visit https://review.coreboot.org/23873 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: newchange Gerrit-Change-Id: If1ac6db16647eba4ddb28b74d1e0501224c841df Gerrit-Change-Number: 23873 Gerrit-PatchSet: 1 Gerrit-Owner: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com>

1 0

Change in coreboot[master]: soc/intel/skylake: Move PCR DMI programming into bootblock
by build bot (Jenkins) (Code Review) Feb. 26, 2018

Feb. 26, 2018

build bot (Jenkins) has posted comments on this change. ( https://review.coreboot.org/23866 ) Change subject: soc/intel/skylake: Move PCR DMI programming into bootblock ...................................................................... Patch Set 3: Verified+1 Build Successful https://qa.coreboot.org/job/coreboot-gerrit/67942/ : SUCCESS https://qa.coreboot.org/job/coreboot-checkpatch/22422/ : SUCCESS -- To view, visit https://review.coreboot.org/23866 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ie706735492a450baa653d8a8bb74c6e42f5150b8 Gerrit-Change-Number: 23866 Gerrit-PatchSet: 3 Gerrit-Owner: Subrata Banik <subrata.banik(a)intel.com> Gerrit-Reviewer: Aaron Durbin <adurbin(a)chromium.org> Gerrit-Reviewer: Furquan Shaikh <furquan(a)google.com> Gerrit-Reviewer: Paul Menzel <paulepanter(a)users.sourceforge.net> Gerrit-Reviewer: PraveenX Hodagatta Pranesh <praveenx.hodagatta.pranesh(a)intel.com> Gerrit-Reviewer: Rizwan Qureshi <rizwan.qureshi(a)intel.com> Gerrit-Reviewer: Subrata Banik <subrata.banik(a)intel.com> Gerrit-Reviewer: Tung Lun Loo <tung.lun.loo(a)intel.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Mon, 26 Feb 2018 17:44:58 +0000 Gerrit-HasComments: No Gerrit-HasLabels: Yes

1 0

Change in coreboot[master]: soc/intel/denverton_ns: Fill dimm info for SMBIOS table 17
by build bot (Jenkins) (Code Review) Feb. 26, 2018

Feb. 26, 2018

build bot (Jenkins) has posted comments on this change. ( https://review.coreboot.org/23851 ) Change subject: soc/intel/denverton_ns: Fill dimm info for SMBIOS table 17 ...................................................................... Patch Set 3: Verified+1 Build Successful https://qa.coreboot.org/job/coreboot-gerrit/67941/ : SUCCESS https://qa.coreboot.org/job/coreboot-checkpatch/22421/ : SUCCESS -- To view, visit https://review.coreboot.org/23851 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Id5c4ceaf4e65359f72ec764f0914b5daa82f257e Gerrit-Change-Number: 23851 Gerrit-PatchSet: 3 Gerrit-Owner: Julien Viard de Galbert <jviarddegalbert(a)online.net> Gerrit-Reviewer: David Guckian <david.guckian(a)intel.com> Gerrit-Reviewer: Julien Viard de Galbert <jviarddegalbert(a)online.net> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Reviewer: Paul Menzel <paulepanter(a)users.sourceforge.net> Gerrit-Reviewer: Shine Liu <shine.liu(a)intel.com> Gerrit-Reviewer: Vanessa Eusebio <vanessa.f.eusebio(a)intel.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Mon, 26 Feb 2018 17:41:07 +0000 Gerrit-HasComments: No Gerrit-HasLabels: Yes

1 0