Felix Singer has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/83295?usp=email )
Change subject: Update vboot submodule to upstream main
......................................................................
Update vboot submodule to upstream main
Updating from commit id 09fcd218:
2024-02-23 06:42:12 +0000 - (Makefile: Test compiler for -Wincompatible-function-pointer-types)
to commit id b6f44e62:
2024-07-01 04:30:14 +0000 - (futility: updater: Increase try count from 8 to 10)
This brings in 58 new commits:
b6f44e62 futility: updater: Increase try count from 8 to 10
cfc87db2 OWNERS: Add czapiga
eabf5784 OWNERS: Remove twawrzynczak and quasisec
f8af818e host: Add stub implementation for pkcs11 key
aaf4ecbb crossystem: Add support for Panther Lake gpiochip
de89c5cd make_dev_ssd: allow ptracers to write proc/mem
ffc9cc15 utility: Add vbnv_util.py for debugging
b6174bdb futility: show: Print keyblock signature size and data size
6e39c99f Android: Add support for doing zipalign before doing apksigner
ead73381 futility: flash: Enhance WP status reporting by adding more instructions
c3368084 futility: modify private key validation to work for both local and cloud
c22d72f8 futility: flash: Correct the output syntax of 32bit hex
f423ae13 crossystem: Drop support for tried_fwb and fwb_tries
fc5488c7 futility: flash: Correct the allowlist of options
16dede85 Revert "futility: Split load_firmware_image() into two functions for AP and EC"
ded07831 futility: Try to load ecrw versions regardless of image type
7a685705 futility: Refactor code for --manifest
f5ad0856 futility: Add more checks for incompatible arguments
05659d33 futility/updater_manifest: Warn about inconsistent RW versions
6720827b futility: Support ecrw version for --manifest
daae7e56 futility: Split load_firmware_image() into two functions for AP and EC
40c77bba futility: Warn about inconsistent RW_FWID_A and RW_FWID_B versions
c168ac8e tests/futility/data: Update bios_geralt_cbfs.bin with swapped ecrw
512648ae host/lib: Add cbfstool_file_exists() and cbfstool_extract()
e37e6511 sign_official_build: add missing info keyword
2c0758b4 sign_official_build: loem support for firmware
016f6149 scripts/image_signing/swap_ec_rw: Always add ecrw.* as raw CBFS file
b26c700a scripts/image_signing/swap_ecrw: Support ecrw.version
2e8d1003 tlcl: Add const qualifier to TlclTakeOwnership arguments
96b8674c host: stop installing unused image signing scripts
8da83c43 Android: Handle update certs using for hardcoded certs
4ca60534 scripts/image_signing: Add swap_ec_rw
d30d6b54 make_dev_ssd: Remove logic choosing editor value
4cc5d090 futility/dump_fmap: Fix error message prefix for '-x'
e7062a58 futility/dump_fmap: Exit with error if specified section is not found
4489dd09 scripts: Remove newbitmaps directory
8dcc82b0 host/lib/cbfstool: Redesign cbfstool_get_config_value() API
856fd693 Android: Hack for now to let things silently fail instead of erroring
28845c97 sign_uefi: Handle case where the crdyshim key does not exist
201244c3 sign_uefi_unittest: Refactor in preparation for more tests
702f8b53 tests: Add tests for cbfstool_get_config_value()
52a21327 Android: Add support for gcloud KMS in android signing
3310c49f tests/futility/test_update.sh: Use unique test names for IFD tests
493f7afc sign_gsc_firmware: add support for Nightly target
5c307cad keycfg: more consistent typo fix
11e4f60b image_signing: Add missing arg in sign_uefi_kernel
37c730d8 keycfg: handle arrays appropriately in key_config
59c37697 sign_uefi: Add detached crdyboot signature
b66926e2 sign_uefi: Refactor the is-pkcs11 function for reuse
94aa8b80 image_signing: Pass crdyshim private key to sign_uefi.py
0ac99bcb sign_uefi: Stop signing crdyboot files with sbsign
6f6a6432 vboot_reference-sys: replace denylist with allowlist
73ebd8f8 vboot_reference-sys: add vboot_host pkg-config fallback
476282ef make_dev_ssd: Skip firmware validity checks on nonchrome
9330a65a vboot_reference: Add support for allowing overlayfs
48c8833f sign_official_build: remove cloud-signing
aa70bb19 create_new_keys.sh: add --arv-root-uri
38d1af69 sign_official_build: Dedup calls to sign_uefi.py
Change-Id: I14aaf1e1e230107e7bae60195c7e4684bf5a0533
Signed-off-by: Felix Singer <felixsinger(a)posteo.net>
---
M 3rdparty/vboot
1 file changed, 1 insertion(+), 1 deletion(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/95/83295/1
diff --git a/3rdparty/vboot b/3rdparty/vboot
index 09fcd21..b6f44e6 160000
--- a/3rdparty/vboot
+++ b/3rdparty/vboot
@@ -1 +1 @@
-Subproject commit 09fcd2184f9c714829503e84b8a7dfe7f2584e00
+Subproject commit b6f44e62650e563cca651bd4349c418450dd1bd3
--
To view, visit https://review.coreboot.org/c/coreboot/+/83295?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: coreboot
Gerrit-Branch: main
Gerrit-Change-Id: I14aaf1e1e230107e7bae60195c7e4684bf5a0533
Gerrit-Change-Number: 83295
Gerrit-PatchSet: 1
Gerrit-Owner: Felix Singer <service+coreboot-gerrit(a)felixsinger.de>
Attention is currently required from: Arthur Heymans, Felix Held, Julius Werner, Jérémy Compostella, Karthik Ramasubramanian, Paul Menzel, Simon Glass.
Simon Glass has posted comments on this change by Simon Glass. ( https://review.coreboot.org/c/coreboot/+/77712?usp=email )
Change subject: Introduce a coreboot Control Block (CCB)
......................................................................
Patch Set 12:
(1 comment)
Patchset:
PS10:
> Yes it can be done with FMAP but it does create a lot of new code. […]
OK I have updated this to support FMAP. It is now split into four commits
--
To view, visit https://review.coreboot.org/c/coreboot/+/77712?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: coreboot
Gerrit-Branch: main
Gerrit-Change-Id: I04e946b33035a493e833500351a0483761252613
Gerrit-Change-Number: 77712
Gerrit-PatchSet: 12
Gerrit-Owner: Simon Glass <sjg(a)chromium.org>
Gerrit-Reviewer: Felix Singer <service+coreboot-gerrit(a)felixsinger.de>
Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org>
Gerrit-Reviewer: Jérémy Compostella <jeremy.compostella(a)intel.com>
Gerrit-Reviewer: Karthik Ramasubramanian <kramasub(a)google.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-CC: Felix Held <felix-coreboot(a)felixheld.de>
Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-CC: Simon Glass <sjg(a)chromium.org>
Gerrit-Attention: Simon Glass <sjg(a)chromium.org>
Gerrit-Attention: Jérémy Compostella <jeremy.compostella(a)intel.com>
Gerrit-Attention: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Attention: Julius Werner <jwerner(a)chromium.org>
Gerrit-Attention: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Attention: Karthik Ramasubramanian <kramasub(a)google.com>
Gerrit-Attention: Felix Held <felix-coreboot(a)felixheld.de>
Gerrit-Comment-Date: Mon, 01 Jul 2024 11:27:32 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Arthur Heymans <arthur(a)aheymans.xyz>
Comment-In-Reply-To: Simon Glass <sjg(a)chromium.org>
Comment-In-Reply-To: Felix Held <felix-coreboot(a)felixheld.de>
Simon Glass has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/83293?usp=email )
Change subject: Support CCB at a fixed SPI-flash offset
......................................................................
Support CCB at a fixed SPI-flash offset
Enhance the CCB to allow it to be in an FMAP region, instead of embedded
in the bootblock. This adds quite a bit of logic, particularly in
cbfstool which must now support adjusting the CCB region automatically.
This creates a CCB region in the FMAP containing the CCB. This is added
to the ROM during the build.
BUG=b:172341184, b:262546009, b:249105972
BRANCH=none
TEST=manually test each of the three options using:
make menuconfig; (select option); rm -r build && make -j30
qemu-system-x86_64 -bios build/coreboot.rom -nographic
(see that console appears)
build/util/cbfstool/cbfstool build/coreboot.rom
configure -n console -V quiet
qemu-system-x86_64 -bios build/coreboot.rom -nographic
(see that console is suppressed, except for first part of bootblock with
CCB_CBFS and CCB_FMAP)
Change-Id: I8abc5ba55d75a3defdea548fffcedba74d4737c2
Signed-off-by: Simon Glass <sjg(a)chromium.org>
---
M Documentation/technotes/ccb.md
M Makefile.mk
M src/Kconfig
M src/commonlib/include/commonlib/ccb.h
M src/commonlib/include/commonlib/region.h
M src/lib/bootblock.c
M src/lib/ccb.c
M util/cbfstool/cbfstool.c
M util/cbfstool/default-x86.fmd
9 files changed, 145 insertions(+), 22 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/93/83293/1
diff --git a/Documentation/technotes/ccb.md b/Documentation/technotes/ccb.md
index bdb9b18..63cca83 100644
--- a/Documentation/technotes/ccb.md
+++ b/Documentation/technotes/ccb.md
@@ -84,11 +84,22 @@
the CCB_CBFS option. This applies mostly to AMD, since Intel platforms, do not
have a signed bootblock.
-## Future extensions
+For boards where it is not possible or desirable to access CBFS files early in
+bootblock, an FMAP region can be used to hold the CCB. Care should be taken that
+this region is in read-only flash, if preventing users from changing it is
+important.
-CCB could be stored in an FMAP region.
+If something goes wrong with the CCB init while the console is off, the
+ccb_check() function can be called to see what happened.
+
+## Future extensions
The CMOS option feature (in `include/option.h`) could be expanded to provide an
API for CCB. Using strings for options might be too inefficient for bootblock,
so an enum could be introduced for common option types, with a lookup table used
to convert between strings and integers.
+
+The initial bootblock output could be suppressed, even with the CCB_CBFS and
+CCB_FMAP options, by just living with the risk that something goes wrong in
+setting up FMAP / CBFS. This would be best handled by enabling the CCB option
+only when the board is working correctly.
diff --git a/Makefile.mk b/Makefile.mk
index 16b6539..077898f 100644
--- a/Makefile.mk
+++ b/Makefile.mk
@@ -485,6 +485,10 @@
CPPFLAGS_common += -D__BUILD_DIR__=\"$(obj)\"
CPPFLAGS_common += -D__COREBOOT__
+# Must be >= sizeof(struct ccb)
+CCB_SIZE := 16
+CPPFLAGS_common += -DCCB_SIZE=$(CCB_SIZE)
+
ifeq ($(BUILD_TIMELESS),1)
CPPFLAGS_common += -D__TIMELESS__
endif
@@ -1078,6 +1082,17 @@
FMAP_SPD_CACHE_ENTRY :=
endif
+# Align CCB end so that FMAP doesn't end up in a strange place and bootblock
+# won't fit in what remains
+ifeq ($(CONFIG_CCB_FMAP),y)
+FMAP_CCB_BASE := $(call int-align, $(FMAP_CURRENT_BASE), 0x10)
+FMAP_CCB_SIZE := $(call int-align, $(CCB_SIZE), 0x200)
+FMAP_CCB_ENTRY := CCB@$(FMAP_CCB_BASE) $(FMAP_CCB_SIZE)
+FMAP_CURRENT_BASE := $(call int-add, $(FMAP_CCB_BASE) $(FMAP_CCB_SIZE))
+else
+FMAP_CCB_ENTRY :=
+endif
+
ifeq ($(CONFIG_VPD),y)
FMAP_VPD_BASE := $(call int-align, $(FMAP_CURRENT_BASE), 0x4000)
FMAP_VPD_SIZE := $(CONFIG_VPD_FMAP_SIZE)
@@ -1173,6 +1188,7 @@
-e "s,##MRC_CACHE_ENTRY##,$(FMAP_MRC_CACHE_ENTRY)," \
-e "s,##SMMSTORE_ENTRY##,$(FMAP_SMMSTORE_ENTRY)," \
-e "s,##SPD_CACHE_ENTRY##,$(FMAP_SPD_CACHE_ENTRY)," \
+ -e "s,##CCB_ENTRY##,$(FMAP_CCB_ENTRY)," \
-e "s,##VPD_ENTRY##,$(FMAP_VPD_ENTRY)," \
-e "s,##HSPHY_FW_ENTRY##,$(FMAP_HSPHY_FW_ENTRY)," \
-e "s,##CBFS_BASE##,$(FMAP_CBFS_BASE)," \
@@ -1203,6 +1219,10 @@
add_bootblock = $(CBFSTOOL) $(1) write -u -r BOOTBLOCK -f $(2)
endif
+ifneq ($(CONFIG_ARCH_X86),)
+add_ccb = $(CBFSTOOL) $(1) write -u -r CCB -f $(2)
+endif
+
# coreboot.pre doesn't follow the standard Make conventions. It gets modified
# by multiple rules, and thus we can't compute the dependencies correctly.
$(shell rm -f $(obj)/coreboot.pre)
@@ -1212,6 +1232,12 @@
$(CBFSTOOL) $@.tmp create -M $(obj)/fmap.fmap -r $(shell cat $(obj)/fmap.desc)
printf " BOOTBLOCK\n"
$(call add_bootblock,$@.tmp,$(objcbfs)/bootblock.bin)
+ifneq ($(CONFIG_CCB_FMAP),)
+ # Force use of shell so these hex values work
+ /usr/bin/printf "\x01\xb0\x43\xc0" >$(objcbfs)/ccb.bin
+ truncate -s $(CCB_SIZE) $(objcbfs)/ccb.bin
+ $(call add_ccb,$@.tmp,$(objcbfs)/ccb.bin)
+endif
$(prebuild-files) true
mv $@.tmp $@
else # ifneq ($(CONFIG_UPDATE_IMAGE),y)
diff --git a/src/Kconfig b/src/Kconfig
index bee8363..3594e60 100644
--- a/src/Kconfig
+++ b/src/Kconfig
@@ -616,6 +616,18 @@
See Documentation/util/cbfstool/ccb.md for more information.
+config CCB_FMAP
+ bool "Read coreboot control block from fixed ROM offset"
+ depends on CCB
+ help
+ Enable this to read the CCB (coreboot control block) from a fixed ROM
+ offset. The file is read after CBFS is inited in bootblock.
+
+ The CCB provides a few simple settings for coreboot which can be
+ changed using the 'cbfstool set-ccb' command.
+
+ See Documentation/util/cbfstool/ccb.md for more information.
+
endchoice
menu "Software Bill Of Materials (SBOM)"
diff --git a/src/commonlib/include/commonlib/ccb.h b/src/commonlib/include/commonlib/ccb.h
index b77a256..26bdb8d 100644
--- a/src/commonlib/include/commonlib/ccb.h
+++ b/src/commonlib/include/commonlib/ccb.h
@@ -25,6 +25,12 @@
/* Magic number at the top of the CCB and used to detect it in the bootblock */
#define CCB_MAGIC 0xc043b001
+/* Name of CCB FMAP region, if CONFIG_CCB_FMAP is enabled */
+#define CCB_REGION "CCB"
+
+/* Assumed maximum size of CCB (can be larger than sizeof(struct ccb) */
+#define CCB_MAX_SIZE 0x10
+
/**
* struct ccb - Data in the CCB
*
diff --git a/src/commonlib/include/commonlib/region.h b/src/commonlib/include/commonlib/region.h
index 25efcc8..a224cb6 100644
--- a/src/commonlib/include/commonlib/region.h
+++ b/src/commonlib/include/commonlib/region.h
@@ -94,6 +94,11 @@
}, \
}
+static inline bool rdev_valid(const struct region_device *rdev)
+{
+ return rdev->ops != NULL;
+}
+
/* Helper to dynamically initialize region device. */
void region_device_init(struct region_device *rdev,
const struct region_device_ops *ops, size_t offset,
diff --git a/src/lib/bootblock.c b/src/lib/bootblock.c
index 454e538..9284c66 100644
--- a/src/lib/bootblock.c
+++ b/src/lib/bootblock.c
@@ -60,7 +60,7 @@
exception_init();
}
- /* late init of CCB for when CCB is in CBFS */
+ /* late init of CCB for when CCB is in CBFS or FMAP */
if (!ENV_HOLDS_CCB) {
ccb_init();
diff --git a/src/lib/ccb.c b/src/lib/ccb.c
index c45ea04..0c61a23 100644
--- a/src/lib/ccb.c
+++ b/src/lib/ccb.c
@@ -5,6 +5,7 @@
#include <cbmem.h>
#include <commonlib/ccb_api.h>
#include <console/console.h>
+#include <fmap.h>
#include <program_loading.h>
#include <string.h>
#include <symbols.h>
@@ -16,6 +17,12 @@
};
#endif
+_Static_assert(sizeof(struct ccb) <= CCB_SIZE,
+ "CCB_SIZE must be no smaller than sizeof(struct ccb)");
+
+/* copy of CCB when read from an rdev */
+static struct ccb ccb_holder;
+
/* holds the global pointer to the coreboot Control Block, NULL if none */
static const struct ccb *ccb_glob;
@@ -49,7 +56,7 @@
CBMEM_READY_HOOK(add_ccb_to_cbmem);
/* Get a pointer to the CCB. Returns NULL if not found */
-static struct ccb *locate_ccb(void)
+static struct ccb *locate_ccb(struct region_device *rdev)
{
struct ccb *ccb;
@@ -62,6 +69,7 @@
* entry so it is accessible through the post-RAM stages
* 3. (ramstage) The CCB is in CBMEM. It can be accessed directly.
*/
+ memset(rdev, '\0', sizeof(*rdev));
#if ENV_HOLDS_CCB
ccb = &ccb_static;
if (REGION_SIZE(ccb) < sizeof(*ccb))
@@ -79,18 +87,28 @@
printk(BIOS_ERR, "CCB: Not found in CBMEM\n");
} else if (CONFIG(CCB_CBFS)) {
struct prog ccb_file = PROG_INIT(PROG_CCB, "ccb");
- struct region_device rdev;
union cbfs_mdata mdata;
- if (_cbfs_boot_lookup(prog_name(&ccb_file), true, &mdata, &rdev)) {
+ if (_cbfs_boot_lookup(prog_name(&ccb_file), true, &mdata, rdev)) {
printk(BIOS_DEBUG, "CCB: No file in CBFS\n");
return NULL;
}
- if (region_device_sz(&rdev) != sizeof(struct ccb)) {
+ if (region_device_sz(rdev) != sizeof(struct ccb)) {
printk(BIOS_ERR, "CCB: Incorrect file size in CBFS\n");
return NULL;
}
- ccb = rdev_mmap_full(&rdev);
+ ccb = rdev_mmap_full(rdev);
+ } else if (CONFIG(CCB_FMAP)) {
+ if (fmap_locate_area_as_rdev(CCB_REGION, rdev)) {
+ printk(BIOS_ERR, "CCB: Not found in FMAP\n");
+ return NULL;
+ }
+ ccb = rdev_mmap_full(rdev);
+ if (!ccb) {
+ printk(BIOS_ERR, "CCB: Cannot map\n");
+ return NULL;
+ }
+ printk(BIOS_DEBUG, "CCB: Found in FMAP\n");
} else {
/* we cannot get here */
BUG();
@@ -102,24 +120,35 @@
void ccb_check(void)
{
+ struct region_device rdev;
struct ccb *ccb;
- ccb = locate_ccb();
- if (ccb)
+ ccb = locate_ccb(&rdev);
+ if (ccb) {
printk(BIOS_DEBUG, "CCB: ready\n");
+ if (rdev_valid(&rdev))
+ rdev_munmap(&rdev, ccb);
+ }
}
void ccb_init(void)
{
+ struct region_device rdev;
struct ccb *ccb;
- ccb = locate_ccb();
+ ccb = locate_ccb(&rdev);
if (ccb) {
#if ENV_BOOTBLOCK
/* Copy the CCB into the cache for use by romstage. In the event
* that CCB is missing, zero values will be used */
memcpy((void *)_ccb, ccb, sizeof(*ccb));
#endif
+
+ if (rdev_valid(&rdev)) {
+ ccb_holder = *ccb;
+ rdev_munmap(&rdev, ccb);
+ ccb = &ccb_holder;
+ }
ccb_glob = ccb;
}
}
diff --git a/util/cbfstool/cbfstool.c b/util/cbfstool/cbfstool.c
index 987f71e..57fbc6b6 100644
--- a/util/cbfstool/cbfstool.c
+++ b/util/cbfstool/cbfstool.c
@@ -13,6 +13,7 @@
#include "cbfs_image.h"
#include "cbfs_sections.h"
#include "elfparsing.h"
+#include "fmap.h"
#include "partitioned_file.h"
#include "lz4/lib/xxhash.h"
#include <commonlib/bsd/cbfs_private.h>
@@ -676,13 +677,20 @@
return ret;
}
+/* location of CCB, with respect to the image regions (>0 is an error) */
+enum ccb_location {
+ CCB_IN_PRIMARY_CBFS = 0,
+ CCB_IN_OWN_REGION = -1,
+ CCB_NOT_FOUND = 1
+};
+
/**
* locate_ccb() - Locate the coreboot Control Block in the CBFS image
*
* This is located in the bootblock and has a special signature
*
* @ccbp: Returns a pointer to the CCB
- * Return: 0 if OK, 1 on error
+ * Return: 0 if OK, 1 on error, -1 if the CCB region must be written back
*/
static int locate_ccb(struct buffer *buffer, struct ccb **ccbp)
{
@@ -695,10 +703,12 @@
goto no_bootblock;
if (fmap_find_area(fmap, SECTION_NAME_BOOTBLOCK)) {
+ INFO("Reading bootblock\n");
if (!partitioned_file_read_region(buffer, param.image_file,
SECTION_NAME_BOOTBLOCK))
goto no_bootblock;
} else {
+ INFO("Reading CBFS\n");
if (!partitioned_file_read_region(buffer, param.image_file,
SECTION_NAME_PRIMARY_CBFS))
goto no_bootblock;
@@ -708,22 +718,37 @@
size = buffer_size(buffer);
for (ptr = (uint32_t *)data, end = (uint32_t *)(data + size); ptr < end;
- ptr++) {
+ ptr++) {
if (*ptr == CCB_MAGIC) {
*ccbp = (struct ccb *)ptr;
- return 0;
+ INFO("CCB at %p, from size %lx\n", ptr, size);
+ return CCB_IN_PRIMARY_CBFS;
}
}
INFO("CCB not in bootblock\n");
+ /* Now try FMAP */
+ const struct fmap_area *area;
+
+ area = fmap_find_area(fmap, CCB_REGION);
+ if (area) {
+ printk(BIOS_DEBUG, "CCB: Found in FMAP\n");
+ if (!partitioned_file_read_region(buffer, param.image_file,
+ CCB_REGION))
+ goto no_bootblock;
+
+ *ccbp = (void *)buffer_get(buffer); // + area->offset;
+ return CCB_IN_OWN_REGION;
+ }
+
struct cbfs_image image;
struct cbfs_file *ccb_file;
const char *filename = "ccb";
struct buffer ccb_buf;
if (cbfs_image_from_buffer(&image, param.image_region, param.headeroffset))
- return 1;
+ return CCB_NOT_FOUND;
ccb_file = cbfs_get_entry(&image, filename);
if (!ccb_file) {
@@ -734,7 +759,7 @@
INFO("CCB not in CBFS: creating\n");
if (buffer_create(&ccb_buf, sizeof(struct ccb), filename))
- return 1;
+ return CCB_NOT_FOUND;
header = cbfs_create_file_header(CBFS_TYPE_RAW, ccb_buf.size,
filename);
@@ -748,24 +773,24 @@
buffer_delete(&ccb_buf);
if (ret) {
ERROR("Failed to add '%s' into ROM image.\n", filename);
- return 1;
+ return CCB_NOT_FOUND;
}
ccb_file = cbfs_get_entry(&image, filename);
}
if (!ccb_file) {
ERROR("Cannot get file\n");
- return 1;
+ return CCB_NOT_FOUND;
}
/* Locate the CCB */
*ccbp = (void *)ccb_file + be32toh(ccb_file->offset);
- return 0;
+ return CCB_IN_PRIMARY_CBFS;
no_bootblock:
ERROR("CCB not in ROM image?!?\n");
- return 1;
+ return CCB_NOT_FOUND;
}
/**
@@ -777,11 +802,13 @@
*/
static int cbfs_ccb_set_value(unused const char *name, unused const char *value)
{
+ enum ccb_location ccb_loc;
struct buffer buffer;
struct ccb *ccb;
uint val;
- if (locate_ccb(&buffer, &ccb))
+ ccb_loc = locate_ccb(&buffer, &ccb);
+ if (ccb_loc > 0)
return 1;
/*
@@ -803,6 +830,12 @@
printf("%s=%s\n", name, value);
ccb->flags = val;
+ if (ccb_loc == CCB_IN_OWN_REGION) {
+ INFO("Performing operation on '%s' region...\n", CCB_REGION);
+ if (!partitioned_file_write_region(param.image_file, &buffer))
+ return 1;
+ }
+
return 0;
}
@@ -819,7 +852,7 @@
struct buffer buffer;
struct ccb *ccb;
- if (locate_ccb(&buffer, &ccb))
+ if (locate_ccb(&buffer, &ccb) > 0)
return 1;
/*
* For now this code is very simple as we only have one setting. We can
diff --git a/util/cbfstool/default-x86.fmd b/util/cbfstool/default-x86.fmd
index f008889..ec57c06 100644
--- a/util/cbfstool/default-x86.fmd
+++ b/util/cbfstool/default-x86.fmd
@@ -15,6 +15,7 @@
##SPD_CACHE_ENTRY##
##VPD_ENTRY##
##HSPHY_FW_ENTRY##
+ ##CCB_ENTRY##
FMAP@##FMAP_BASE## ##FMAP_SIZE##
COREBOOT(CBFS)@##CBFS_BASE## ##CBFS_SIZE##
}
--
To view, visit https://review.coreboot.org/c/coreboot/+/83293?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: coreboot
Gerrit-Branch: main
Gerrit-Change-Id: I8abc5ba55d75a3defdea548fffcedba74d4737c2
Gerrit-Change-Number: 83293
Gerrit-PatchSet: 1
Gerrit-Owner: Simon Glass <sjg(a)chromium.org>
Simon Glass has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/83292?usp=email )
Change subject: Support CCB in a CBFS file
......................................................................
Support CCB in a CBFS file
Enhance the CCB to allow it to be in a CBFS file, instead of embedded in
the bootblock. This is fairly straightforward, with just a little more
logic in the CCB implementation and cbfstool.
The CBFS file is not added by the build, so configuration must be
updated afterwards using cbfstool, otherwise a default CCB (all zeroes)
is used.
Note that with this option the CCB init happens later in bootblock, so
that the first part of the bootblock console output cannot be controlled
by CCB. This is because we want to avoid accessing FMAP/CBFS when the
console is off, in case something goes wrong.
BUG=b:172341184, b:262546009, b:249105972
BRANCH=none
TEST=see next CL
Change-Id: Id67e472afa67909065f1b1e45e5a8c2f112af367
Signed-off-by: Simon Glass <sjg(a)chromium.org>
---
M Documentation/technotes/ccb.md
M src/Kconfig
M src/include/program_loading.h
M src/lib/bootblock.c
M src/lib/ccb.c
M util/cbfstool/cbfstool.c
6 files changed, 91 insertions(+), 2 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/92/83292/1
diff --git a/Documentation/technotes/ccb.md b/Documentation/technotes/ccb.md
index f913cca..bdb9b18 100644
--- a/Documentation/technotes/ccb.md
+++ b/Documentation/technotes/ccb.md
@@ -77,9 +77,14 @@
and into CBMEM. Thus it can be used by the following stages which don't have
access to the cache.
-## Future extensions
+Some boards use a signed bootblock which cannot easily be modified after
+building, since it requires resigning parts of the image. To address this, the
+CCB can be stored in CBFS instead, accessed from the romstage. This means it is
+unable to affect the operation of bootblock, of course. This is controlled by
+the CCB_CBFS option. This applies mostly to AMD, since Intel platforms, do not
+have a signed bootblock.
-CCB could be stored in a CBFS file.
+## Future extensions
CCB could be stored in an FMAP region.
diff --git a/src/Kconfig b/src/Kconfig
index 6ce95a1..bee8363 100644
--- a/src/Kconfig
+++ b/src/Kconfig
@@ -604,6 +604,18 @@
See Documentation/util/cbfstool/ccb.md for more information.
+config CCB_CBFS
+ bool "Read coreboot control block from CBFS"
+ depends on CCB
+ help
+ Enable this to read the CCB (coreboot control block) from a file in
+ CBFS. The file is read after CBFS is inited in bootblock.
+
+ The CCB provides a few simple settings for coreboot which can be
+ changed using the 'cbfstool set-ccb' command.
+
+ See Documentation/util/cbfstool/ccb.md for more information.
+
endchoice
menu "Software Bill Of Materials (SBOM)"
diff --git a/src/include/program_loading.h b/src/include/program_loading.h
index e53cb7c..dad6b41 100644
--- a/src/include/program_loading.h
+++ b/src/include/program_loading.h
@@ -25,6 +25,7 @@
PROG_BL32,
PROG_POSTCAR,
PROG_OPENSBI,
+ PROG_CCB,
};
/*
diff --git a/src/lib/bootblock.c b/src/lib/bootblock.c
index de95e61..454e538 100644
--- a/src/lib/bootblock.c
+++ b/src/lib/bootblock.c
@@ -51,6 +51,7 @@
if (CONFIG(CMOS_POST))
cmos_post_init();
+ /* if CCB is available without any setup, init it now */
if (ENV_HOLDS_CCB)
ccb_init();
@@ -59,6 +60,14 @@
exception_init();
}
+ /* late init of CCB for when CCB is in CBFS */
+ if (!ENV_HOLDS_CCB) {
+ ccb_init();
+
+ /* check if the console should be silent */
+ console_check_silent();
+ }
+
bootblock_soc_init();
bootblock_mainboard_init();
diff --git a/src/lib/ccb.c b/src/lib/ccb.c
index b50a7f9..c45ea04 100644
--- a/src/lib/ccb.c
+++ b/src/lib/ccb.c
@@ -77,6 +77,20 @@
ccb = cbmem_find(CBMEM_ID_CCB);
if (!ccb) /* This should not happen */
printk(BIOS_ERR, "CCB: Not found in CBMEM\n");
+ } else if (CONFIG(CCB_CBFS)) {
+ struct prog ccb_file = PROG_INIT(PROG_CCB, "ccb");
+ struct region_device rdev;
+ union cbfs_mdata mdata;
+
+ if (_cbfs_boot_lookup(prog_name(&ccb_file), true, &mdata, &rdev)) {
+ printk(BIOS_DEBUG, "CCB: No file in CBFS\n");
+ return NULL;
+ }
+ if (region_device_sz(&rdev) != sizeof(struct ccb)) {
+ printk(BIOS_ERR, "CCB: Incorrect file size in CBFS\n");
+ return NULL;
+ }
+ ccb = rdev_mmap_full(&rdev);
} else {
/* we cannot get here */
BUG();
diff --git a/util/cbfstool/cbfstool.c b/util/cbfstool/cbfstool.c
index 07fc057..987f71e 100644
--- a/util/cbfstool/cbfstool.c
+++ b/util/cbfstool/cbfstool.c
@@ -715,6 +715,54 @@
}
}
+ INFO("CCB not in bootblock\n");
+
+ struct cbfs_image image;
+ struct cbfs_file *ccb_file;
+ const char *filename = "ccb";
+ struct buffer ccb_buf;
+
+ if (cbfs_image_from_buffer(&image, param.image_region, param.headeroffset))
+ return 1;
+
+ ccb_file = cbfs_get_entry(&image, filename);
+ if (!ccb_file) {
+ struct cbfs_file *header;
+ struct ccb *ccb;
+ int ret;
+
+ INFO("CCB not in CBFS: creating\n");
+
+ if (buffer_create(&ccb_buf, sizeof(struct ccb), filename))
+ return 1;
+
+ header = cbfs_create_file_header(CBFS_TYPE_RAW, ccb_buf.size,
+ filename);
+
+ ccb = buffer_get(&ccb_buf);
+ memset(ccb, '\0', sizeof(struct ccb));
+ ccb->magic = CCB_MAGIC;
+
+ ret = cbfs_add_entry(&image, &ccb_buf, 0, header, 0);
+ free(header);
+ buffer_delete(&ccb_buf);
+ if (ret) {
+ ERROR("Failed to add '%s' into ROM image.\n", filename);
+ return 1;
+ }
+ ccb_file = cbfs_get_entry(&image, filename);
+ }
+
+ if (!ccb_file) {
+ ERROR("Cannot get file\n");
+ return 1;
+ }
+
+ /* Locate the CCB */
+ *ccbp = (void *)ccb_file + be32toh(ccb_file->offset);
+
+ return 0;
+
no_bootblock:
ERROR("CCB not in ROM image?!?\n");
return 1;
--
To view, visit https://review.coreboot.org/c/coreboot/+/83292?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: coreboot
Gerrit-Branch: main
Gerrit-Change-Id: Id67e472afa67909065f1b1e45e5a8c2f112af367
Gerrit-Change-Number: 83292
Gerrit-PatchSet: 1
Gerrit-Owner: Simon Glass <sjg(a)chromium.org>
Attention is currently required from: Jérémy Compostella.
Hello build bot (Jenkins),
I'd like you to reexamine a change. Please visit
https://review.coreboot.org/c/coreboot/+/79594?usp=email
to look at the new patch set (#3).
Change subject: Post-build control of serial
......................................................................
Post-build control of serial
Use the new 'coreboot Control Block' (CCB) to control console output,
including the very first bootblock banner.
This involves moving console_init() later in a few cases, so that CBMEM
is available. Otherwise the postcar and ramstage will output a banner
even when the console is silent.
Provide a feature in cbfstool to enable and disable the console output.
This adds only around 100 bytes to the bootblock size on x86 machines,
so is small enough to be enabled in most cases.
BUG=none
BRANCH=none
TEST=make (to build coreboot)
$ cbfstool build/coreboot.rom ccb-get -n console
console=loud
First try this to see that the bootblock outputs its banner:
$ qemu-system-i386 -bios build/coreboot.rom -nographic |head -5
[NOTE ] coreboot-4.21 Fri Nov 17 12:09:01 UTC 2023 x86_32
bootblock starting (log level: 7)...
...
Now set it to silent and try again, to see that the bootblock output is
suppressed, so that the first output shown is the romstage:
$ cbfstool build/coreboot.rom ccb-get -n console -V silent
console=silent
$ qemu-system-i386 -bios build/coreboot.rom -nographic
(no output)
Change-Id: Ibd867950f117cc6b3dbc582505f3983a0dd714fb
Signed-off-by: Simon Glass <sjg(a)chromium.org>
---
M Documentation/util/cbfstool/ccb.md
M src/arch/x86/postcar.c
M src/commonlib/include/commonlib/ccb.h
M src/console/Kconfig
M src/console/console.c
M src/console/init.c
M src/include/console/console.h
M src/include/console/streams.h
M src/lib/hardwaremain.c
M util/cbfstool/cbfstool.c
10 files changed, 117 insertions(+), 15 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/94/79594/3
--
To view, visit https://review.coreboot.org/c/coreboot/+/79594?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: coreboot
Gerrit-Branch: main
Gerrit-Change-Id: Ibd867950f117cc6b3dbc582505f3983a0dd714fb
Gerrit-Change-Number: 79594
Gerrit-PatchSet: 3
Gerrit-Owner: Simon Glass <sjg(a)chromium.org>
Gerrit-Reviewer: Jérémy Compostella <jeremy.compostella(a)intel.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Attention: Jérémy Compostella <jeremy.compostella(a)intel.com>
Attention is currently required from: Arthur Heymans, Felix Held, Julius Werner, Jérémy Compostella, Karthik Ramasubramanian, Paul Menzel, Simon Glass.
Hello Felix Singer, Julius Werner, Jérémy Compostella, Karthik Ramasubramanian, build bot (Jenkins),
I'd like you to reexamine a change. Please visit
https://review.coreboot.org/c/coreboot/+/77712?usp=email
to look at the new patch set (#11).
The following approvals got outdated and were removed:
Verified+1 by build bot (Jenkins)
Change subject: Introduce a coreboot Control Block (CCB)
......................................................................
Introduce a coreboot Control Block (CCB)
It is annoying to have to create and maintain two completely
different builds of coreboot just make minor changes, such as to enable
or disable the console.
It would be much more convenient to have a 'silent' flag in the
image, which can be updated as needed, without needing to rebuild
coreboot.
Introduce the 'coreboot Control Block' (CCB) which can hold such
settings. It is designed to be available very early in bootblock,
before CBFS is ready. It is able to control the output of the very
first bootblock banner.
The CCB is then passed through the cache and placed in cbmem so it is
available to other stages.
Provide options in cbfstool to get and set settings in the CCB. This
makes it easy to use this feature.
BUG=b:172341184, b:262546009, b:249105972
BRANCH=none
TEST=see next CL
Change-Id: I04e946b33035a493e833500351a0483761252613
Signed-off-by: Simon Glass <sjg(a)chromium.org>
---
A Documentation/technotes/ccb.md
M Documentation/technotes/index.md
A Documentation/util/cbfstool/ccb.md
M Documentation/util/cbfstool/index.md
M src/Kconfig
M src/arch/x86/car.ld
M src/arch/x86/postcar.c
M src/arch/x86/romstage.c
M src/commonlib/bsd/include/commonlib/bsd/cbmem_id.h
A src/commonlib/include/commonlib/ccb.h
A src/commonlib/include/commonlib/ccb_api.h
M src/include/memlayout.h
M src/include/rules.h
M src/include/symbols.h
M src/lib/Makefile.mk
M src/lib/bootblock.c
A src/lib/ccb.c
M src/lib/hardwaremain.c
M util/cbfstool/cbfstool.c
19 files changed, 503 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/12/77712/11
--
To view, visit https://review.coreboot.org/c/coreboot/+/77712?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: coreboot
Gerrit-Branch: main
Gerrit-Change-Id: I04e946b33035a493e833500351a0483761252613
Gerrit-Change-Number: 77712
Gerrit-PatchSet: 11
Gerrit-Owner: Simon Glass <sjg(a)chromium.org>
Gerrit-Reviewer: Felix Singer <service+coreboot-gerrit(a)felixsinger.de>
Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org>
Gerrit-Reviewer: Jérémy Compostella <jeremy.compostella(a)intel.com>
Gerrit-Reviewer: Karthik Ramasubramanian <kramasub(a)google.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-CC: Felix Held <felix-coreboot(a)felixheld.de>
Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-CC: Simon Glass <sjg(a)chromium.org>
Gerrit-Attention: Simon Glass <sjg(a)chromium.org>
Gerrit-Attention: Jérémy Compostella <jeremy.compostella(a)intel.com>
Gerrit-Attention: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Attention: Julius Werner <jwerner(a)chromium.org>
Gerrit-Attention: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Attention: Karthik Ramasubramanian <kramasub(a)google.com>
Gerrit-Attention: Felix Held <felix-coreboot(a)felixheld.de>
Attention is currently required from: Alexander Goncharov, Eric Lai.
Subrata Banik has posted comments on this change by Alexander Goncharov. ( https://review.coreboot.org/c/coreboot/+/83282?usp=email )
Change subject: util/ifdtool: dump SPI modes from FLCOMP
......................................................................
Patch Set 1: Code-Review+2
--
To view, visit https://review.coreboot.org/c/coreboot/+/83282?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: coreboot
Gerrit-Branch: main
Gerrit-Change-Id: I624fe5cb28aa3cb207bc48aa8d31b2a71b70bcf2
Gerrit-Change-Number: 83282
Gerrit-PatchSet: 1
Gerrit-Owner: Alexander Goncharov <chat(a)joursoir.net>
Gerrit-Reviewer: Eric Lai <ericllai(a)google.com>
Gerrit-Reviewer: Subrata Banik <subratabanik(a)google.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Kapil Porwal <kapilporwal(a)google.com>
Gerrit-CC: Leah Rowe <leahleahrowerowe(a)gmail.com>
Gerrit-CC: Reka Norman <rekanorman(a)chromium.org>
Gerrit-Attention: Eric Lai <ericllai(a)google.com>
Gerrit-Attention: Alexander Goncharov <chat(a)joursoir.net>
Gerrit-Comment-Date: Mon, 01 Jul 2024 11:18:50 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes