Olaf Hernandez Beristain has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/48420 )
Change subject: add BASIC interpreter or similar payload to project ideas
......................................................................
add BASIC interpreter or similar payload to project ideas
Change-Id: Ib5cfd6ddf6ddaa384c66c313c993fbfcc911e3c3
---
M Documentation/contributing/project_ideas.md
1 file changed, 11 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/20/48420/1
diff --git a/Documentation/contributing/project_ideas.md b/Documentation/contributing/project_ideas.md
index 141023f..c4c26c5 100644
--- a/Documentation/contributing/project_ideas.md
+++ b/Documentation/contributing/project_ideas.md
@@ -247,3 +247,14 @@
### Mentors
* Patrick Rudolph <patrick.rudolph(a)9elements.com>
* Christian Walter <christian.walter(a)9elements.com>
+
+## Create a BASIC interpreter or similar payload
+A payload that can run a BASIC interpreter or similar. Possibly could be a subset of [GW-BASIC](https://github.com/microsoft/GW-BASIC).
+In fact any code interpreter would be great. Another option is [Forth/Fcode](https://www.openfirmware.info/Forth/FCode)
+
+
+### Requirements
+* coreboot knowledge: Should know how to build coreboot images and
+ include payloads.
+* understanding low level programming
+* know how interpreter works
--
To view, visit https://review.coreboot.org/c/coreboot/+/48420
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ib5cfd6ddf6ddaa384c66c313c993fbfcc911e3c3
Gerrit-Change-Number: 48420
Gerrit-PatchSet: 1
Gerrit-Owner: Olaf Hernandez Beristain <olafitohb(a)gmail.com>
Gerrit-MessageType: newchange
Michał Żygowski has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/43483 )
Change subject: Documentation/vendorcode/eltan/security.md: Fix bugs in the guide
......................................................................
Documentation/vendorcode/eltan/security.md: Fix bugs in the guide
ELTAN verified boot seems to be using vboot 2.1 key format not vboot
1.0. Generating vboot 1.0 keys results in public key of incorrect size
(according to the verified boot implementation in vendorcode) which
results in errors during booting.
Fix the cbfstool extraction command to take account for stage file
which may have certain sections removed.
Add note about endianess of digest generated by openssl.
Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Change-Id: I27cf8e3f8e22876f671092fe4d3265a98564d996
---
M Documentation/vendorcode/eltan/security.md
1 file changed, 8 insertions(+), 2 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/83/43483/1
diff --git a/Documentation/vendorcode/eltan/security.md b/Documentation/vendorcode/eltan/security.md
index 9dd47c0..1c05cd5 100644
--- a/Documentation/vendorcode/eltan/security.md
+++ b/Documentation/vendorcode/eltan/security.md
@@ -42,7 +42,7 @@
Create private key in RSA2048 format: `openssl genrsa -F4 -out <private_key_file> 2048`
Create public key using private key:
-`futility --vb1 create <private_key_file> <public_key_file_without_extension>`
+`futility --vb21 create <private_key_file> <public_key_file_without_extension>`
The public key will be included into coreboot and used for verified boot only.
@@ -79,9 +79,15 @@
The total number of items must match `VENDORCODE_ELTAN_OEM_MANIFEST_ITEMS`.
For every part the SHA (SHA-256) must be calculated. First extract the binary from the coreboot
-image using: `cbfstool <coreboot_file_name> extract -n <cbfs_name> -f <item_binary_file_name>`
+image using: `cbfstool <coreboot_file_name> extract -n <cbfs_name> -f <item_binary_file_name> -m x86 -U`
+Note the `-m x86 -U` flags are required for correct extraction of stages. Certain stages are
+put in CBFS without certain program sections so extraction process must also remove these sections.
+
followed by: `openssl dgst -sha256 -binary -out <hash_file_name> <item_binary_file_name>`
+The SHA256 digest will be in big endian so it must be converted to little endian with:
+`< <hash_file_name> xxd -p -c1 | tac | xxd -p -r > <hash_file_name_le>`
+
Replace -sha256 with -sha512 when `VENDORCODE_ELTAN_VBOOT_USE_SHA512` is enabled.
All the hashes must be combined to a hash binary. The hashes need to be placed in the same order as
--
To view, visit https://review.coreboot.org/c/coreboot/+/43483
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I27cf8e3f8e22876f671092fe4d3265a98564d996
Gerrit-Change-Number: 43483
Gerrit-PatchSet: 1
Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Gerrit-MessageType: newchange
Patrick Rudolph has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/40829 )
Change subject: [WIP]security: Add option to lock regions for SMMSTORE
......................................................................
[WIP]security: Add option to lock regions for SMMSTORE
On many server boards the flash is updateable out of band using the BMC
and the bios region doesn't need to be writeable except for the
SMM_STORE.
Add an option to write-protect the COREBOOT and FMAP region.
UNTESTED.
Change-Id: I1096be9650f2af3e886f12f7db50c5060e0d40e1
Signed-off-by: Patrick Rudolph <patrick.rudolph(a)9elements.com>
---
M src/security/lockdown/Kconfig
M src/security/lockdown/lockdown.c
2 files changed, 36 insertions(+), 2 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/29/40829/1
diff --git a/src/security/lockdown/Kconfig b/src/security/lockdown/Kconfig
index 30b5237..d24c5e5 100644
--- a/src/security/lockdown/Kconfig
+++ b/src/security/lockdown/Kconfig
@@ -72,6 +72,23 @@
is either triggered by coreboot (when INTEL_CHIPSET_LOCKDOWN is set) or
has to be triggered later (e.g. by the payload or the OS).
+config BOOTMEDIA_LOCK_COREBOOT_FMAP_RO
+ depends on BOOTMEDIA_LOCK_CONTROLLER
+ bool "Write-protect COREBOOT and FMAP region in boot medium"
+ help
+ Select this if you want to write-protect the COREBOOT and FMAP region
+ as specified in the FMAP. You will be able to write every region outside
+ of COREBOOT and FMAP using the internal controller (eg. SMM_STORE).
+
+ The locking will take place during the chipset lockdown.
+ Chipset lockdown is platform specific und might be done unconditionally,
+ when INTEL_CHIPSET_LOCKDOWN is set or has to be triggered later
+ (e.g. by the payload or the OS).
+
+ NOTE: If you trigger the chipset lockdown unconditionally,
+ you won't be able to write to update coreboot using the internal
+ controller any more.
+
endchoice
config BOOTMEDIA_LOCK_IN_VERSTAGE
diff --git a/src/security/lockdown/lockdown.c b/src/security/lockdown/lockdown.c
index 62d0a29..b4698d7 100644
--- a/src/security/lockdown/lockdown.c
+++ b/src/security/lockdown/lockdown.c
@@ -28,8 +28,11 @@
} else if (CONFIG(BOOTMEDIA_LOCK_WPRO_VBOOT_RO)) {
printk(BIOS_DEBUG, "'WP_RO only'");
lock_type = CTRLR_WP;
+ } else if (CONFIG(BOOTMEDIA_LOCK_COREBOOT_FMAP_RO)) {
+ printk(BIOS_DEBUG, "'COREBOOT and FMAP'");
+ lock_type = CTRLR_WP;
}
- printk(BIOS_DEBUG, "using CTRL...\n");
+ printk(BIOS_DEBUG, " using CTRL...\n");
} else {
if (CONFIG(BOOTMEDIA_LOCK_WHOLE_RO)) {
printk(BIOS_DEBUG, "'readonly'");
@@ -38,7 +41,7 @@
printk(BIOS_DEBUG, "'WP_RO only'");
lock_type = MEDIA_WP;
}
- printk(BIOS_DEBUG, "using flash chip...\n");
+ printk(BIOS_DEBUG, " using flash chip...\n");
}
if (CONFIG(BOOTMEDIA_LOCK_WPRO_VBOOT_RO)) {
@@ -46,6 +49,11 @@
printk(BIOS_ERR, "BM-LOCKDOWN: Could not find region 'WP_RO'\n");
else
rdev = &dev;
+ } else if (CONFIG(BOOTMEDIA_LOCK_COREBOOT_FMAP_RO)) {
+ if (fmap_locate_area_as_rdev("COREBOOT", &dev) < 0)
+ printk(BIOS_ERR, "BM-LOCKDOWN: Could not find region 'COREBOOT'\n");
+ else
+ rdev = &dev;
} else {
rdev = boot_device_ro();
}
@@ -54,6 +62,15 @@
printk(BIOS_INFO, "BM-LOCKDOWN: Enabled bootmedia protection\n");
else
printk(BIOS_ERR, "BM-LOCKDOWN: Failed to enable bootmedia protection\n");
+
+ if (CONFIG(BOOTMEDIA_LOCK_COREBOOT_FMAP_RO)) {
+ if (fmap_locate_area_as_rdev("FMAP", &dev) < 0)
+ printk(BIOS_ERR, "BM-LOCKDOWN: Could not find region 'FMAP'\n");
+ else if (boot_device_wp_region(&dev, lock_type) >= 0)
+ printk(BIOS_INFO, "BM-LOCKDOWN: Enabled bootmedia protection\n");
+ else
+ printk(BIOS_ERR, "BM-LOCKDOWN: Failed to enable bootmedia protection\n");
+ }
}
static void lock(void *unused)
--
To view, visit https://review.coreboot.org/c/coreboot/+/40829
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I1096be9650f2af3e886f12f7db50c5060e0d40e1
Gerrit-Change-Number: 40829
Gerrit-PatchSet: 1
Gerrit-Owner: Patrick Rudolph <patrick.rudolph(a)9elements.com>
Gerrit-MessageType: newchange