Patrick Rudolph has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/40829 )
Change subject: [WIP]security: Add option to lock regions for SMMSTORE
......................................................................
[WIP]security: Add option to lock regions for SMMSTORE
On many server boards the flash is updateable out of band using the BMC
and the bios region doesn't need to be writeable except for the
SMM_STORE.
Add an option to write-protect the COREBOOT and FMAP region.
UNTESTED.
Change-Id: I1096be9650f2af3e886f12f7db50c5060e0d40e1
Signed-off-by: Patrick Rudolph <patrick.rudolph(a)9elements.com>
---
M src/security/lockdown/Kconfig
M src/security/lockdown/lockdown.c
2 files changed, 36 insertions(+), 2 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/29/40829/1
diff --git a/src/security/lockdown/Kconfig b/src/security/lockdown/Kconfig
index 30b5237..d24c5e5 100644
--- a/src/security/lockdown/Kconfig
+++ b/src/security/lockdown/Kconfig
@@ -72,6 +72,23 @@
is either triggered by coreboot (when INTEL_CHIPSET_LOCKDOWN is set) or
has to be triggered later (e.g. by the payload or the OS).
+config BOOTMEDIA_LOCK_COREBOOT_FMAP_RO
+ depends on BOOTMEDIA_LOCK_CONTROLLER
+ bool "Write-protect COREBOOT and FMAP region in boot medium"
+ help
+ Select this if you want to write-protect the COREBOOT and FMAP region
+ as specified in the FMAP. You will be able to write every region outside
+ of COREBOOT and FMAP using the internal controller (eg. SMM_STORE).
+
+ The locking will take place during the chipset lockdown.
+ Chipset lockdown is platform specific und might be done unconditionally,
+ when INTEL_CHIPSET_LOCKDOWN is set or has to be triggered later
+ (e.g. by the payload or the OS).
+
+ NOTE: If you trigger the chipset lockdown unconditionally,
+ you won't be able to write to update coreboot using the internal
+ controller any more.
+
endchoice
config BOOTMEDIA_LOCK_IN_VERSTAGE
diff --git a/src/security/lockdown/lockdown.c b/src/security/lockdown/lockdown.c
index 62d0a29..b4698d7 100644
--- a/src/security/lockdown/lockdown.c
+++ b/src/security/lockdown/lockdown.c
@@ -28,8 +28,11 @@
} else if (CONFIG(BOOTMEDIA_LOCK_WPRO_VBOOT_RO)) {
printk(BIOS_DEBUG, "'WP_RO only'");
lock_type = CTRLR_WP;
+ } else if (CONFIG(BOOTMEDIA_LOCK_COREBOOT_FMAP_RO)) {
+ printk(BIOS_DEBUG, "'COREBOOT and FMAP'");
+ lock_type = CTRLR_WP;
}
- printk(BIOS_DEBUG, "using CTRL...\n");
+ printk(BIOS_DEBUG, " using CTRL...\n");
} else {
if (CONFIG(BOOTMEDIA_LOCK_WHOLE_RO)) {
printk(BIOS_DEBUG, "'readonly'");
@@ -38,7 +41,7 @@
printk(BIOS_DEBUG, "'WP_RO only'");
lock_type = MEDIA_WP;
}
- printk(BIOS_DEBUG, "using flash chip...\n");
+ printk(BIOS_DEBUG, " using flash chip...\n");
}
if (CONFIG(BOOTMEDIA_LOCK_WPRO_VBOOT_RO)) {
@@ -46,6 +49,11 @@
printk(BIOS_ERR, "BM-LOCKDOWN: Could not find region 'WP_RO'\n");
else
rdev = &dev;
+ } else if (CONFIG(BOOTMEDIA_LOCK_COREBOOT_FMAP_RO)) {
+ if (fmap_locate_area_as_rdev("COREBOOT", &dev) < 0)
+ printk(BIOS_ERR, "BM-LOCKDOWN: Could not find region 'COREBOOT'\n");
+ else
+ rdev = &dev;
} else {
rdev = boot_device_ro();
}
@@ -54,6 +62,15 @@
printk(BIOS_INFO, "BM-LOCKDOWN: Enabled bootmedia protection\n");
else
printk(BIOS_ERR, "BM-LOCKDOWN: Failed to enable bootmedia protection\n");
+
+ if (CONFIG(BOOTMEDIA_LOCK_COREBOOT_FMAP_RO)) {
+ if (fmap_locate_area_as_rdev("FMAP", &dev) < 0)
+ printk(BIOS_ERR, "BM-LOCKDOWN: Could not find region 'FMAP'\n");
+ else if (boot_device_wp_region(&dev, lock_type) >= 0)
+ printk(BIOS_INFO, "BM-LOCKDOWN: Enabled bootmedia protection\n");
+ else
+ printk(BIOS_ERR, "BM-LOCKDOWN: Failed to enable bootmedia protection\n");
+ }
}
static void lock(void *unused)
--
To view, visit https://review.coreboot.org/c/coreboot/+/40829
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I1096be9650f2af3e886f12f7db50c5060e0d40e1
Gerrit-Change-Number: 40829
Gerrit-PatchSet: 1
Gerrit-Owner: Patrick Rudolph <patrick.rudolph(a)9elements.com>
Gerrit-MessageType: newchange
Rizwan Qureshi has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/32078
Change subject: mb/google/hatch:[DEBUG ONLY] Assert DEVSLP in S3
......................................................................
mb/google/hatch:[DEBUG ONLY] Assert DEVSLP in S3
It was obsevred that the DEVSLP is keeping low in S3, and SDD is drawing
some power, assert DEVSLP in S3 to indicate SSD to go into low power mode.
Change-Id: I001781fd0e1e5763f6865966658fc9fccc3edff8
Signed-off-by: Rizwan Qureshi <rizwan.qureshi(a)intel.com>
---
M src/mainboard/google/hatch/variants/baseboard/gpio.c
1 file changed, 1 insertion(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/78/32078/1
diff --git a/src/mainboard/google/hatch/variants/baseboard/gpio.c b/src/mainboard/google/hatch/variants/baseboard/gpio.c
index 5987abc..15038b5 100644
--- a/src/mainboard/google/hatch/variants/baseboard/gpio.c
+++ b/src/mainboard/google/hatch/variants/baseboard/gpio.c
@@ -410,6 +410,7 @@
/* Default GPIO settings before entering sleep. */
static const struct pad_config default_sleep_gpio_table[] = {
+ PAD_CFG_GPO(GPP_E5, 1, DEEP),
};
/*
--
To view, visit https://review.coreboot.org/c/coreboot/+/32078
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I001781fd0e1e5763f6865966658fc9fccc3edff8
Gerrit-Change-Number: 32078
Gerrit-PatchSet: 1
Gerrit-Owner: Rizwan Qureshi <rizwan.qureshi(a)intel.com>
Gerrit-MessageType: newchange
Calvin has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/31849
Change subject: Updated and converted to markdown doc from wiki on porting motherboards.
......................................................................
Updated and converted to markdown doc from wiki on porting motherboards.
Some of the documentation from the wiki (https://www.coreboot.org/Motherboard_Porting_Guide) has been ported to markdown and updated as I was able to figure things out. Still a work in progress as there is more data from that page that I will need to convert as I work through it. If I get anywhere in my project of porting coreboot to an older Chromebook, I will document more of this process as I go.
Signed-off-by: calvinrempel <calvin.rempel(a)gmail.com>
Change-Id: Ie3b8a99c10808c7e7ebc826b4d2f992774cc9a75
---
M Documentation/index.md
A Documentation/porting/index.md
A Documentation/porting/motherboard_probe.md
3 files changed, 135 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/49/31849/1
diff --git a/Documentation/index.md b/Documentation/index.md
index dd8714c..32635f9 100644
--- a/Documentation/index.md
+++ b/Documentation/index.md
@@ -164,6 +164,7 @@
* [Rookie Guide](lessons/index.md)
* [Coding Style](coding_style.md)
* [Project Ideas](contributing/project_ideas.md)
+* [Porting](porting/index.md)
* [Code of Conduct](community/code_of_conduct.md)
* [Community forums](community/forums.md)
* [coreboot at conferences](community/conferences.md)
diff --git a/Documentation/porting/index.md b/Documentation/porting/index.md
new file mode 100644
index 0000000..ed282e8
--- /dev/null
+++ b/Documentation/porting/index.md
@@ -0,0 +1,3 @@
+# Porting New Boards
+
+* [Motherboard Probing](motherboard_probe.md)
diff --git a/Documentation/porting/motherboard_probe.md b/Documentation/porting/motherboard_probe.md
new file mode 100644
index 0000000..7562f7c
--- /dev/null
+++ b/Documentation/porting/motherboard_probe.md
@@ -0,0 +1,131 @@
+Motherboard Porting Guide
+=========================
+
+Please note that this guide is very much a work in progress.
+
+Finding out What You Have
+-------------------------
+
+### Tools
+To begin the process of porting a motherboard to coreboot, you first
+need to determine what all is on it: the chipset (ie, North and South
+Bridge), Flash Rom, etc. To do this, you will need a suite of
+tools provided by the coreboot project, as well as some that can be
+found more readily in various repositories.
+
+For the sake of this page, it will be assumed you are using Debian or
+Ubuntu.
+
+#### Build Environment
+If you have not already done so, get your basic build environment
+installed:
+
+ $ sudo apt install build-essential git cvs subversion
+
+#### Probing Utilities - From Repos
+Next, a number of utilities will need to be installed which will be used
+later for probing the system as well as some dev libraries which will be
+used in building some of the tools in the next step.These should be
+available in your distro's repo:
+
+ $ sudo apt install pciutils pciutils-dev flashrom acpitool \
+ usbutils acpidump
+
+#### Probing Utilities - From Source
+Once the base build system in place and what utilities along with what
+libraries you can glean from your distro's repositories, it is time to
+build some tools from source. If you have not already done so, checkout
+the git repo as described in "[Rookie Guide: Lesson 1]".
+
+Once you have synced the coreboot repo, cd into the utilities folder:
+
+ $cd coreboot/util
+
+##### superiotool
+
+ $ cd ./superiotool
+ $ make
+ $ sudo make install
+ $ cd ..
+
+##### inteltool
+
+ $ cd ./inteltool
+ $ make
+ $ sudo make install
+ $ cd ..
+
+##### ectool
+
+ $ cd ./ectool
+ $ make
+ $ make install
+ $ cd ..
+
+##### dmidecode
+
+ $ cvs -z3 -d:pserver:anonymous@cvs.savannah.nongnu.org:/sources/dmidecode \
+ co dmidecode
+ $ cd dmidecode
+ $ make
+ $ sudo make install
+ $ cd ..
+
+##### msrtool
+
+ $ cd ./msrtool
+ $ ./configure
+ $ make
+ $ sudo make install
+ $ cd ..
+
+##### nvramtool
+
+ $ cd ./nvramtool
+ $ make
+ $ sudo make install
+
+##### acpica-unix
+
+ $ wget http://deb.debian.org/debian/pool/main/a/acpica-unix/acpica-unix_20181213.o…
+ $ tar -xaf acpica-unix_20181213.orig.tar.gz
+ $ cd ./acpica-unix-2018-12-13/
+ $ make
+ $ sudo make install
+
+### Probe the Board
+Now we will begin to probe the board to see what we can find out about
+it. First, become root:
+
+ $ sudo su
+
+Then load the msr module into the kernel:
+
+ $ sudo modprobe msr
+
+Finally, we probe the board:
+
+ $ lspci -nnvvvxxxx > lspci.log 2> lspci.err.log
+ $ lsusb -vvv > lsusb.log 2> lsusb.err.log
+ $ superiotool -deV > superiotool.log 2> superiotool.err.log
+ $ inteltool -a > inteltool.log 2> inteltool.err.log
+ $ ectool -i > ectool.log 2> ectool.err.log
+ $ msrtool > msrtool.log 2> msrtool.err.log
+ $ dmidecode > dmidecode.log 2> dmidecode.err.log
+ $ biosdecode > biosdecode.log 2> biosdecode.err.log
+ $ nvramtool -x > nvramtool.log 2> nvramtool.err.log
+ $ dmesg > dmesg.log 2> dmesg.err.log
+ $ acpidump > acpidump.log 2> acpidump.err.log
+ $ for x in /sys/class/sound/card0/hw*; do cat "$x/init_pin_configs" \
+ > pin_"$(basename "$x")"; done
+ $ for x in /proc/asound/card0/codec#*; do cat "$x" > \
+ "$(basename "$x")"; done
+ $ cat /proc/cpuinfo > cpuinfo.log 2> cpuinfo.err.log
+ $ cat /proc/ioports > ioports.log 2> ioports.err.log
+ $ cat /sys/class/input/input*/id/bustype > input_bustypes.log
+ $flashrom -V -p internal:laptop=force_I_want_a_brick > \
+ flashrom_info.log 2> flashrom_info.err.log
+ $ flashrom -V -p internal:laptop=force_I_want_a_brick -r rom.bin > \
+ flashrom_read.log 2> flashrom_read.err.log
+
+[Rookie Guide: Lesson 1]: https://doc.coreboot.org/lessons/lesson1.html
--
To view, visit https://review.coreboot.org/c/coreboot/+/31849
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ie3b8a99c10808c7e7ebc826b4d2f992774cc9a75
Gerrit-Change-Number: 31849
Gerrit-PatchSet: 1
Gerrit-Owner: Calvin <calvin.rempel(a)gmail.com>
Gerrit-MessageType: newchange
You-Cheng Syu has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/32333
Change subject: util/mtkheader: Add a tool to extract bootload header from binary files.
......................................................................
util/mtkheader: Add a tool to extract bootload header from binary files.
Add a tool, extract-bl-img.py, which can extract MTK bootload header
from binary files. This could be useful for boards (e.g., Kukui) which
put the bootblock in other places (e.g., Chrome EC).
Change-Id: Ib744c80bdc2adfe27d4287365e161096e3fe08c7
Signed-off-by: You-Cheng Syu <youcheng(a)google.com>
---
A util/mtkheader/extract-bl-img.py
1 file changed, 55 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/33/32333/1
diff --git a/util/mtkheader/extract-bl-img.py b/util/mtkheader/extract-bl-img.py
new file mode 100755
index 0000000..21bf9eb
--- /dev/null
+++ b/util/mtkheader/extract-bl-img.py
@@ -0,0 +1,55 @@
+#!/usr/bin/env python
+# This file is part of the coreboot project.
+#
+# Copyright 2019 Google LLC
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+
+import argparse
+import struct
+import sys
+
+
+_DESCRIPTION = 'Extract MTK bootload header from a binary file.'
+
+
+def parse_args():
+ parser = argparse.ArgumentParser(description=_DESCRIPTION)
+ parser.add_argument('input_path', metavar='INPUT_FILE')
+ parser.add_argument('output_path', metavar='OUTPUT_FILE')
+ return parser.parse_args()
+
+
+def main():
+ args = parse_args()
+
+ with open(args.input_path, 'rb') as f:
+ data = f.read()
+
+ header = struct.pack('<8sII', 'BRLYT', 1, 2048)
+
+ start = -1
+ while True:
+ start = data.find(header, start + 1)
+ if start < 0:
+ raise RuntimeError('Cannot find MTK bootload header')
+ offset = start + len(header)
+ buf = struct.unpack('<II', data[offset:offset+8])
+ if buf[1] == 0x42424242:
+ break
+ size = buf[0]
+ offset = start - 512
+
+ with open(args.output_path, 'wb') as f:
+ f.write(data[offset:offset+size])
+
+
+if __name__ == '__main__':
+ main()
--
To view, visit https://review.coreboot.org/c/coreboot/+/32333
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ib744c80bdc2adfe27d4287365e161096e3fe08c7
Gerrit-Change-Number: 32333
Gerrit-PatchSet: 1
Gerrit-Owner: You-Cheng Syu <youcheng(a)google.com>
Gerrit-MessageType: newchange