Paul Fagerburg has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/35607 )
Change subject: vboot: verify the GBB_HWID as part of the build steps
......................................................................
vboot: verify the GBB_HWID as part of the build steps
The GBB_HWID has to end with a value based on the CRC-32 of
the first part of the string. We've been using a manual process
to generate the full GBB_HWID, and there have been errors. As
part of the build process, verify that the GBB_HWID conforms to
the standard, and stop the build if it doesn't, so we don't
get the "your computer is configured with a malformed hardware ID"
error that prevents Chrome OS from updating.
BUG=b:140067412
Signed-off-by: Paul Fagerburg <pfagerburg(a)chromium.org>
Change-Id: Ibfef1b118dca0927ef09674351f26cb2a5ad2171
---
M src/security/vboot/Makefile.inc
A src/security/vboot/check_hwid.sh
2 files changed, 53 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/07/35607/1
diff --git a/src/security/vboot/Makefile.inc b/src/security/vboot/Makefile.inc
index 3078e30..0f96ddb 100644
--- a/src/security/vboot/Makefile.inc
+++ b/src/security/vboot/Makefile.inc
@@ -241,6 +241,7 @@
$(obj)/gbb.region: $(obj)/gbb.stub
@printf " SETUP GBB\n"
+ check_hwid.sh "$(CONFIG_GBB_HWID)"
cp $< $@.tmp
$(FUTILITY) gbb_utility -s \
--hwid="$(CONFIG_GBB_HWID)" \
diff --git a/src/security/vboot/check_hwid.sh b/src/security/vboot/check_hwid.sh
new file mode 100755
index 0000000..fd1a40d
--- /dev/null
+++ b/src/security/vboot/check_hwid.sh
@@ -0,0 +1,52 @@
+#!/bin/bash
+#
+# This file is part of the coreboot project.
+#
+# Copyright 2019 Google LLC.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+
+if [[ "$#" -ne 1 ]]; then
+ echo "Usage: $0 hwid"
+ echo "e.g. $0 \"KOHAKU TEST 1953\""
+ echo "Determine if the HWID is valid by recalculating the CRC and"
+ echo "comparing the result with the original."
+ exit 1
+fi
+
+HWID="${1}"
+
+# The hwid string should end with a space and some numbers.
+# We want all of the string but the last space and the numbers.
+# `cut` only understands counting forward from 1, not counting
+# backward from the end, so use `rev`.
+BASE=$(echo "${HWID}" | rev | cut -d" " -f 2- | rev)
+
+# Get a temporary file, because `crc32` will only work on files,
+# not stdin or a string on the command line.
+TMP="$(mktemp)"
+echo -n "${BASE}" > "${TMP}"
+CRC=$(crc32 "${TMP}")
+rm -f "${TMP}"
+
+# `crc32` gives us a hex value, but without the leading 0x.
+# Convert from hex to decimal.
+CRC=$((16#${CRC}))
+
+# Take the 4 low digits (i.e. modulo 10000).
+DIGITS=$(echo "${CRC}" | rev | cut -c 1-4 | rev)
+
+# The recomputed HWID is the base string plus a space and the 4 digits.
+HWID2="${BASE} ${DIGITS}"
+
+if [[ ! "${HWID}" = "${HWID2}" ]]; then
+ echo "${HWID} fails validation, should be ${HWID2}"
+ exit 1
+fi
--
To view, visit https://review.coreboot.org/c/coreboot/+/35607
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ibfef1b118dca0927ef09674351f26cb2a5ad2171
Gerrit-Change-Number: 35607
Gerrit-PatchSet: 1
Gerrit-Owner: Paul Fagerburg <pfagerburg(a)chromium.org>
Gerrit-MessageType: newchange
Frans Hendriks has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/33442
Change subject: vendorcode/eltan/security: Use config VENDORCODE_ELTAN_XXX
......................................................................
vendorcode/eltan/security: Use config VENDORCODE_ELTAN_XXX
To avoid confusion use VENDORCODE_ELTAN_VBOOT and
VENDORCODE_ELTAN_MBOOT config values.
Inlcude verfied_boot and mboot subdirectories as CPPFLAGS when
measured boot or verified boot is enabled. This allows to generate
binary with measured boot enabled only.
BUG=N/A
TEST=Boot Linux 4.20 and verify logging on Facebook FBG-1701
Change-Id: Iaaf3c8cacbc8d2be7387264ca9c973e583871f0a
Signed-off-by: Frans Hendriks <fhendriks(a)eltan.com>
---
M src/vendorcode/eltan/security/Makefile.inc
1 file changed, 2 insertions(+), 5 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/42/33442/1
diff --git a/src/vendorcode/eltan/security/Makefile.inc b/src/vendorcode/eltan/security/Makefile.inc
index 26b324b..16f17fd 100644
--- a/src/vendorcode/eltan/security/Makefile.inc
+++ b/src/vendorcode/eltan/security/Makefile.inc
@@ -1,6 +1,6 @@
## This file is part of the coreboot project.
##
-## Copyright (C) 2018 Eltan B.V.
+## Copyright (C) 2018-2019 Eltan B.V.
##
## This program is free software; you can redistribute it and/or modify
## it under the terms of the GNU General Public License as published by
@@ -16,12 +16,9 @@
subdirs-y += verified_boot
subdirs-y += mboot
-ifeq ($(CONFIG_MBOOT), y)
+ifneq ($(filter y,$(CONFIG_VENDORCODE_ELTAN_VBOOT) $(CONFIG_VENDORCODE_ELTAN_MBOOT)),)
CPPFLAGS_common += -I$(src)/vendorcode/eltan/security/mboot
CPPFLAGS_common += -I$(src)/vendorcode/eltan/security/include
-endif
-
-ifeq ($(CONFIG_VERIFIED_BOOT), y)
CPPFLAGS_common += -I$(src)/vendorcode/eltan/security/verified_boot
endif
--
To view, visit https://review.coreboot.org/c/coreboot/+/33442
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Iaaf3c8cacbc8d2be7387264ca9c973e583871f0a
Gerrit-Change-Number: 33442
Gerrit-PatchSet: 1
Gerrit-Owner: Frans Hendriks <fhendriks(a)eltan.com>
Gerrit-MessageType: newchange
Alexander Couzens has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/35626 )
Change subject: superio: add support for IT8380
......................................................................
Patch Set 2:
This change is ready for review.
--
To view, visit https://review.coreboot.org/c/coreboot/+/35626
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ife2bafa073d714d58756510018632e97d86aa280
Gerrit-Change-Number: 35626
Gerrit-PatchSet: 2
Gerrit-Owner: Alexander Couzens <lynxis(a)fe80.eu>
Gerrit-Reviewer: Alexander Couzens <lynxis(a)fe80.eu>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Paul Menzel <paulepanter(a)users.sourceforge.net>
Gerrit-Comment-Date: Thu, 26 Sep 2019 20:39:50 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: No
Gerrit-MessageType: comment
Kyösti Mälkki has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/26447 )
Change subject: device: Introduce pcidev_on_root() and friends
......................................................................
Patch Set 25:
(1 comment)
https://review.coreboot.org/c/coreboot/+/26447/25/src/device/device_const.c
File src/device/device_const.c:
https://review.coreboot.org/c/coreboot/+/26447/25/src/device/device_const.c…
PS25, Line 43: result = 0;
> I can add a comment if you think this function will live on longer than a few months. Let me know.
Better you add the comment since we have CB:34084 too. This has to live until amdfam10 is wiped with next release, maybe late this year.
--
To view, visit https://review.coreboot.org/c/coreboot/+/26447
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ie20598d48b4cf6e35e45fc90804bad4728437fc6
Gerrit-Change-Number: 26447
Gerrit-PatchSet: 25
Gerrit-Owner: Kyösti Mälkki <kyosti.malkki(a)gmail.com>
Gerrit-Reviewer: Aaron Durbin <adurbin(a)chromium.org>
Gerrit-Reviewer: HAOUAS Elyes <ehaouas(a)noos.fr>
Gerrit-Reviewer: Kyösti Mälkki <kyosti.malkki(a)gmail.com>
Gerrit-Reviewer: Nico Huber <nico.h(a)gmx.de>
Gerrit-Reviewer: Paul Menzel <paulepanter(a)users.sourceforge.net>
Gerrit-Reviewer: Werner Zeh <werner.zeh(a)siemens.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Comment-Date: Thu, 26 Sep 2019 18:00:00 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Kyösti Mälkki <kyosti.malkki(a)gmail.com>
Comment-In-Reply-To: Aaron Durbin <adurbin(a)chromium.org>
Gerrit-MessageType: comment
Aaron Durbin has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/26447 )
Change subject: device: Introduce pcidev_on_root() and friends
......................................................................
Patch Set 25:
(1 comment)
https://review.coreboot.org/c/coreboot/+/26447/25/src/device/device_const.c
File src/device/device_const.c:
https://review.coreboot.org/c/coreboot/+/26447/25/src/device/device_const.c…
PS25, Line 43: result = 0;
> Well.. […]
I can add a comment if you think this function will live on longer than a few months. Let me know.
--
To view, visit https://review.coreboot.org/c/coreboot/+/26447
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ie20598d48b4cf6e35e45fc90804bad4728437fc6
Gerrit-Change-Number: 26447
Gerrit-PatchSet: 25
Gerrit-Owner: Kyösti Mälkki <kyosti.malkki(a)gmail.com>
Gerrit-Reviewer: Aaron Durbin <adurbin(a)chromium.org>
Gerrit-Reviewer: HAOUAS Elyes <ehaouas(a)noos.fr>
Gerrit-Reviewer: Kyösti Mälkki <kyosti.malkki(a)gmail.com>
Gerrit-Reviewer: Nico Huber <nico.h(a)gmx.de>
Gerrit-Reviewer: Paul Menzel <paulepanter(a)users.sourceforge.net>
Gerrit-Reviewer: Werner Zeh <werner.zeh(a)siemens.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Comment-Date: Thu, 26 Sep 2019 17:38:28 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Kyösti Mälkki <kyosti.malkki(a)gmail.com>
Comment-In-Reply-To: Aaron Durbin <adurbin(a)chromium.org>
Gerrit-MessageType: comment
Kyösti Mälkki has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/26447 )
Change subject: device: Introduce pcidev_on_root() and friends
......................................................................
Patch Set 25:
(1 comment)
https://review.coreboot.org/c/coreboot/+/26447/25/src/device/device_const.c
File src/device/device_const.c:
https://review.coreboot.org/c/coreboot/+/26447/25/src/device/device_const.c…
PS25, Line 43: result = 0;
> Why didn't we put a comment here indicating why this function sometimes doesn't work? I assume it's […]
Well.. comment was not requested during the review and at least I had hoped in May 2018 that we can just throw this function out the window fast.
--
To view, visit https://review.coreboot.org/c/coreboot/+/26447
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ie20598d48b4cf6e35e45fc90804bad4728437fc6
Gerrit-Change-Number: 26447
Gerrit-PatchSet: 25
Gerrit-Owner: Kyösti Mälkki <kyosti.malkki(a)gmail.com>
Gerrit-Reviewer: Aaron Durbin <adurbin(a)chromium.org>
Gerrit-Reviewer: HAOUAS Elyes <ehaouas(a)noos.fr>
Gerrit-Reviewer: Kyösti Mälkki <kyosti.malkki(a)gmail.com>
Gerrit-Reviewer: Nico Huber <nico.h(a)gmx.de>
Gerrit-Reviewer: Paul Menzel <paulepanter(a)users.sourceforge.net>
Gerrit-Reviewer: Werner Zeh <werner.zeh(a)siemens.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Comment-Date: Thu, 26 Sep 2019 17:37:18 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Aaron Durbin <adurbin(a)chromium.org>
Gerrit-MessageType: comment