Julius Werner has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/41814 )
Change subject: security/vboot: Add option to run verstage before bootblock
......................................................................
Patch Set 7:
(5 comments)
https://review.coreboot.org/c/coreboot/+/41814/7/src/security/vboot/Kconfig
File src/security/vboot/Kconfig:
https://review.coreboot.org/c/coreboot/+/41814/7/src/security/vboot/Kconfig…
PS7, Line 22: config HAVE_PRE_BOOTBLOCK_VBOOT_SUPPORT
You shouldn't need this. The VBOOT_STARTS_IN... options are always selected directly from SoC or mainboard code. The way you can do that (without turning things on inadvertently when VBOOT itself is disabled) is by overriding the config VBOOT option to add another select statement in your SoC Kconfig like this:
config VBOOT
selects VBOOT_STARTS_BEFORE_BOOTBLOCK
(See how the same thing is done in src/soc/intel/cannonlake/Kconfig, for example.)
https://review.coreboot.org/c/coreboot/+/41814/7/src/security/vboot/Makefil…
File src/security/vboot/Makefile.inc:
https://review.coreboot.org/c/coreboot/+/41814/7/src/security/vboot/Makefil…
PS7, Line 100: verstage-$(CONFIG_VBOOT_SEPARATE_VERSTAGE) += verstage.c
nit: maybe move this down to the other !STARTS_BEFORE_BOOTBLOCK block below to keep the stuff belonging to that together?
https://review.coreboot.org/c/coreboot/+/41814/7/src/security/vboot/Makefil…
PS7, Line 147: ifeq ($(CONFIG_VBOOT_STARTS_BEFORE_BOOTBLOCK),)
You've moved this out of an if (SEPARATE_VERSTAGE) block, it needs to stay in there, or it'll try adding verstage.elf in !SEPARATE_VERSTAGE builds.
https://review.coreboot.org/c/coreboot/+/41814/7/src/security/vboot/common.c
File src/security/vboot/common.c:
https://review.coreboot.org/c/coreboot/+/41814/7/src/security/vboot/common.…
PS7, Line 23: (CONFIG(VBOOT_STARTS_BEFORE_BOOTBLOCK) && ENV_SEPARATE_VERSTAGE)))
I think a lot of these statements would become much simpler if you use !STARTS_IN_ROMSTAGE rather than STARTS_IN_BOOTBLOCK || STARTS_BEFORE_BOOTBLOCK, because those often go together. For example this could be
if(wb == NULL && !CONFIG(VBOOT_STARTS_IN_ROMSTAGE) && preram_symbols_available())
https://review.coreboot.org/c/coreboot/+/41814/7/src/security/vboot/vboot_l…
File src/security/vboot/vboot_loader.c:
https://review.coreboot.org/c/coreboot/+/41814/7/src/security/vboot/vboot_l…
PS7, Line 17: (CONFIG(VBOOT_STARTS_IN_BOOTBLOCK) || CONFIG(VBOOT_STARTS_BEFORE_BOOTBLOCK))),
Can be simplified to
(!CONFIG(VBOOT_SEPARATE_VERSTAGE) || CONFIG(VBOOT_STARTS_IN_BOOTBLOCK) || CONFIG(VBOOT_STARTS_BEFORE_BOOTBLOCK)
--
To view, visit https://review.coreboot.org/c/coreboot/+/41814
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I4849777cb7ba9f90fe8428b82c21884d1e662b96
Gerrit-Change-Number: 41814
Gerrit-PatchSet: 7
Gerrit-Owner: Martin Roth <martinroth(a)google.com>
Gerrit-Reviewer: Aaron Durbin <adurbin(a)chromium.org>
Gerrit-Reviewer: Eric Peers <epeers(a)google.com>
Gerrit-Reviewer: Furquan Shaikh <furquan(a)google.com>
Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org>
Gerrit-Reviewer: Patrick Georgi <pgeorgi(a)google.com>
Gerrit-Reviewer: Raul Rangel <rrangel(a)chromium.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Kyösti Mälkki <kyosti.malkki(a)gmail.com>
Gerrit-CC: Paul Menzel <paulepanter(a)users.sourceforge.net>
Gerrit-Comment-Date: Wed, 10 Jun 2020 00:51:10 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Gerrit-MessageType: comment
Nico Huber has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/41815 )
Change subject: console: Update for vboot before bootblock
......................................................................
Patch Set 6:
(1 comment)
https://review.coreboot.org/c/coreboot/+/41815/6/src/console/init.c
File src/console/init.c:
https://review.coreboot.org/c/coreboot/+/41815/6/src/console/init.c@70
PS6, Line 70: CONFIG(EARLY_PCI_BRIDGE)
> I think you missed one negation there? It was stated elsewhere PCI config does not work inside psp-v […]
No negation missed. I just concluded from the cluttered condition
that somebody wants to select both EARLY_PCI_BRIDGE and
VBOOT_STARTS_BEFORE_BOOTBLOCK. Otherwise, this condition
wouldn't need to be touched.
If they are incompatible, what we should do instead is make
EARLY_PCI_BRIDGE depend on !VBOOT_STARTS_BEFORE_BOOTBLOCK.
Just skipping the bridge init doesn't seem reasonable, what
would the verstage be supposed to do with an initialized
console behind an uninitialized bridge? Run into timeouts the
whole day?
--
To view, visit https://review.coreboot.org/c/coreboot/+/41815
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ifc9fb0810e0816fe0a68e52287eda6145043a619
Gerrit-Change-Number: 41815
Gerrit-PatchSet: 6
Gerrit-Owner: Martin Roth <martinroth(a)google.com>
Gerrit-Reviewer: Aaron Durbin <adurbin(a)chromium.org>
Gerrit-Reviewer: Eric Peers <epeers(a)google.com>
Gerrit-Reviewer: Furquan Shaikh <furquan(a)google.com>
Gerrit-Reviewer: Patrick Georgi <pgeorgi(a)google.com>
Gerrit-Reviewer: Raul Rangel <rrangel(a)chromium.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Kyösti Mälkki <kyosti.malkki(a)gmail.com>
Gerrit-CC: Nico Huber <nico.h(a)gmx.de>
Gerrit-CC: Paul Menzel <paulepanter(a)users.sourceforge.net>
Gerrit-Comment-Date: Tue, 09 Jun 2020 22:55:22 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Nico Huber <nico.h(a)gmx.de>
Comment-In-Reply-To: Kyösti Mälkki <kyosti.malkki(a)gmail.com>
Gerrit-MessageType: comment