Stefan Reinauer (stefan.reinauer(a)coreboot.org) just uploaded a new patch set to gerrit, which you can find at http://review.coreboot.org/730
-gerrit
commit a9e4b1ace0c54ef84e4aba8907bc2ea5c090f7e4
Author: Stefan Reinauer <reinauer(a)chromium.org>
Date: Thu Oct 6 16:47:51 2011 -0700
Don't run any option roms stored outside of the system flash
Right now coreboot only executes vga option roms. However, this is not
good enough. For security reasons we want to execute only option roms
stored in our RO CBFS.
This patch adds a new option to disable execution of arbitrary option
ROMs and enables it for all our boards.
Change-Id: I485291c06ec5cd1f875357401831fe32ccfc5f2f
Signed-off-by: Stefan Reinauer <reinauer(a)google.com>
---
src/devices/Kconfig | 13 +++++++++++++
src/devices/pci_rom.c | 6 ++++++
2 files changed, 19 insertions(+), 0 deletions(-)
diff --git a/src/devices/Kconfig b/src/devices/Kconfig
index 572addc..98e8d9f 100644
--- a/src/devices/Kconfig
+++ b/src/devices/Kconfig
@@ -49,6 +49,19 @@ config PCI_ROM_RUN
Examples include IDE/SATA controller option ROMs and option ROMs
for network cards (NICs).
+config ON_DEVICE_ROM_RUN
+ bool "Run option ROMs on PCI devices"
+ default y
+ help
+ Execute option ROMs that are stored on PCI/PCIe/AGP devices.
+
+ If disabled, only option ROMs stored in CBFS will be executed. If
+ you are concerned about security, you might want to disable this
+ option, but it might leave your system in a state of degraded
+ functionality.
+
+ If unsure, say Y
+
choice
prompt "Option ROM execution type"
default PCI_OPTION_ROM_RUN_YABEL if !ARCH_X86
diff --git a/src/devices/pci_rom.c b/src/devices/pci_rom.c
index 471c7e2..1b6f1da 100644
--- a/src/devices/pci_rom.c
+++ b/src/devices/pci_rom.c
@@ -71,9 +71,15 @@ struct rom_header *pci_rom_probe(struct device *dev)
rom_address|PCI_ROM_ADDRESS_ENABLE);
}
+#if CONFIG_ON_DEVICE_ROM_RUN
printk(BIOS_DEBUG, "On card, ROM address for %s = %lx\n",
dev_path(dev), (unsigned long)rom_address);
rom_header = (struct rom_header *)rom_address;
+#else
+ printk(BIOS_DEBUG, "On card option ROM execution disabled "
+ "for %s\n", dev_path(dev));
+ return NULL;
+#endif
}
printk(BIOS_SPEW, "PCI expansion ROM, signature 0x%04x, "
Stefan Reinauer (stefan.reinauer(a)coreboot.org) just uploaded a new patch set to gerrit, which you can find at http://review.coreboot.org/728
-gerrit
commit 47ba453b31fe17ca4afb824d3001bd25ad7822ea
Author: Gabe Black <gabeblack(a)google.com>
Date: Wed Oct 5 01:52:08 2011 -0700
Detect whether the OXPCIE card is really present while in the ROM stage.
Use an int in CAR global data to store whether or not the OXPCIE serial card
is actually there. Also, time out if the card doesn't show up quickly enough,
don't continue initialization if it's not there, and don't make the
initialization routine default to a card if none is found.
Change-Id: I9c72d3abc6ee2867b77ab2f2180e6f01f647af8c
Signed-off-by: Gabe Black <gabeblack(a)google.com>
---
src/arch/x86/lib/romstage_console.c | 5 ++++-
src/drivers/oxford/oxpcie/oxpcie_early.c | 20 +++++++++++++++++---
src/include/uart8250.h | 5 +++++
3 files changed, 26 insertions(+), 4 deletions(-)
diff --git a/src/arch/x86/lib/romstage_console.c b/src/arch/x86/lib/romstage_console.c
index 0f22727..25eda9b 100644
--- a/src/arch/x86/lib/romstage_console.c
+++ b/src/arch/x86/lib/romstage_console.c
@@ -35,7 +35,10 @@ static void console_tx_byte(unsigned char byte)
console_tx_byte('\r');
#if CONFIG_CONSOLE_SERIAL8250MEM
- uart8250_mem_tx_byte(CONFIG_OXFORD_OXPCIE_BASE_ADDRESS + 0x1000, byte);
+ if (oxford_oxpcie_present) {
+ uart8250_mem_tx_byte(
+ CONFIG_OXFORD_OXPCIE_BASE_ADDRESS + 0x1000, byte);
+ }
#endif
#if CONFIG_CONSOLE_SERIAL8250
uart8250_tx_byte(CONFIG_TTYS0_BASE, byte);
diff --git a/src/drivers/oxford/oxpcie/oxpcie_early.c b/src/drivers/oxford/oxpcie/oxpcie_early.c
index 2c7767e..4f7a3cb 100644
--- a/src/drivers/oxford/oxpcie/oxpcie_early.c
+++ b/src/drivers/oxford/oxpcie/oxpcie_early.c
@@ -20,6 +20,8 @@
#include <stdint.h>
#include <arch/io.h>
#include <arch/romcc_io.h>
+#include <cpu/x86/car.h>
+#include <delay.h>
#include <uart8250.h>
#include <device/pci_def.h>
@@ -34,9 +36,13 @@
#define OXPCIE_DEVICE_3 \
PCI_DEV(CONFIG_OXFORD_OXPCIE_BRIDGE_SUBORDINATE, 0, 3)
+#if defined(__PRE_RAM__)
+int oxford_oxpcie_present CAR_GLOBAL;
+
void oxford_init(void)
{
u16 reg16;
+ oxford_oxpcie_present = 1;
/* First we reset the secondary bus */
reg16 = pci_read_config16(PCIE_BRIDGE, PCI_BRIDGE_CONTROL);
@@ -69,11 +75,14 @@ void oxford_init(void)
reg16 |= PCI_COMMAND_MEMORY;
pci_write_config16(PCIE_BRIDGE, PCI_COMMAND, reg16);
- // FIXME Add a timeout or this will hang forever if
- // no device is in the slot.
+ u32 timeout = 20000; // Timeout in 10s of microseconds.
u32 id = 0;
- while ((id == 0) || (id == 0xffffffff))
+ for (;;) {
id = pci_read_config32(OXPCIE_DEVICE, PCI_VENDOR_ID);
+ if (!timeout-- || (id != 0 && id != 0xffffffff))
+ break;
+ udelay(10);
+ }
u32 device = OXPCIE_DEVICE; /* unknown default */
switch (id) {
@@ -90,6 +99,10 @@ void oxford_init(void)
case 0xc1581415: /* e.g. Startech MPEX2S952 */
device = OXPCIE_DEVICE;
break;
+ default:
+ /* No UART here. */
+ oxford_oxpcie_present = 0;
+ return;
}
/* Setup base address on device */
@@ -107,3 +120,4 @@ void oxford_init(void)
uart8250_mem_init(uart0_base, (4000000 / CONFIG_TTYS0_BAUD));
}
+#endif
diff --git a/src/include/uart8250.h b/src/include/uart8250.h
index aa510e5..71b9a5f 100644
--- a/src/include/uart8250.h
+++ b/src/include/uart8250.h
@@ -135,8 +135,13 @@ void uart8250_mem_init(unsigned base_port, unsigned divisor);
u32 uart_mem_init(void);
u32 uartmem_getbaseaddr(void);
+#if defined(__PRE_RAM__) && CONFIG_DRIVERS_OXFORD_OXPCIE && \
+ CONFIG_CONSOLE_SERIAL8250MEM
/* and special init for OXPCIe based cards */
+extern int oxford_oxpcie_present;
+
void oxford_init(void);
+#endif
#endif /* __ROMCC__ */
Stefan Reinauer (stefan.reinauer(a)coreboot.org) just uploaded a new patch set to gerrit, which you can find at http://review.coreboot.org/759
-gerrit
commit a9e4699deb5cd361f3a9e6af51f7b66701623950
Author: Vadim Bendebury <vbendeb(a)chromium.org>
Date: Tue Dec 6 22:14:57 2011 +0000
Fix romcc to compile cleanly
There have been many unused variable assignments in the romcc source
file. They cause multiple warning messages during build process which
in turn make it harder to see the actual error message, when they are
present.
The fix is to remove dead code and to add -Werror to romcc compilation
to avoid issues like this creeping in in the future.
Change-Id: I6f42684f39a4135b0fe64219b8c7f058275c9fee
Signed-off-by: Vadim Bendebury <vbendeb(a)chromium.org>
---
util/romcc/Makefile | 2 +-
util/romcc/romcc.c | 3 +--
2 files changed, 2 insertions(+), 3 deletions(-)
diff --git a/util/romcc/Makefile b/util/romcc/Makefile
index 6543fbb..8242eb5 100644
--- a/util/romcc/Makefile
+++ b/util/romcc/Makefile
@@ -1,7 +1,7 @@
# Move the configuration defines to makefile.conf
CC=gcc
CPPFLAGS=
-CFLAGS= -g -Wall $(CPPFLAGS)
+CFLAGS= -g -Wall -Werror $(CPPFLAGS)
CPROF_FLAGS=-pg -fprofile-arcs
all: romcc test
diff --git a/util/romcc/romcc.c b/util/romcc/romcc.c
index c7ef223..7eee439 100644
--- a/util/romcc/romcc.c
+++ b/util/romcc/romcc.c
@@ -9161,8 +9161,7 @@ static void decompose_compound_types(struct compile_state *state)
{
struct triple *ins, *next, *first;
#if DEBUG_DECOMPOSE_HIRES
- FILE *fp;
- fp = state->dbgout;
+ FILE *fp = state->dbgout;
#endif
first = state->first;
ins = first;
Stefan Reinauer (stefan.reinauer(a)coreboot.org) just uploaded a new patch set to gerrit, which you can find at http://review.coreboot.org/758
-gerrit
commit 16d8070fe7dc4c12d7b19d91c88a8eeca0b10725
Author: Stefan Reinauer <reinauer(a)chromium.org>
Date: Thu Nov 17 13:05:31 2011 -0800
Make PCI CONF2 support a compile time option.
It's not used on any board supported by coreboot but has been
detected at run time since ages. No new boards (since 2000?)
are using the CONF2 method, so it is unlikely we ever have to
turn this on for a board.
Change-Id: I17df94a8a77b9338fde10a6b114b44d393776e66
Signed-off-by: Stefan Reinauer <reinauer(a)google.com>
---
src/arch/x86/Kconfig | 4 ++++
src/arch/x86/lib/Makefile.inc | 4 +---
src/arch/x86/lib/pci_ops_auto.c | 9 ++++++++-
3 files changed, 13 insertions(+), 4 deletions(-)
diff --git a/src/arch/x86/Kconfig b/src/arch/x86/Kconfig
index 078ae95..bc01c9c 100644
--- a/src/arch/x86/Kconfig
+++ b/src/arch/x86/Kconfig
@@ -96,4 +96,8 @@ config LITTLE_ENDIAN
bool
default !BIG_ENDIAN
+config PCI_CONF2
+ bool
+ default n
+
endmenu
diff --git a/src/arch/x86/lib/Makefile.inc b/src/arch/x86/lib/Makefile.inc
index 3f4dc95..96fb9b0 100644
--- a/src/arch/x86/lib/Makefile.inc
+++ b/src/arch/x86/lib/Makefile.inc
@@ -1,10 +1,8 @@
ramstage-y += c_start.S
ramstage-y += cpu.c
ramstage-y += pci_ops_conf1.c
-ramstage-y += pci_ops_conf2.c
-
+ramstage-$(CONFIG_PCI_CONF2) += pci_ops_conf2.c
ramstage-$(CONFIG_MMCONF_SUPPORT) += pci_ops_mmconf.c
-
ramstage-y += pci_ops_auto.c
ramstage-y += exception.c
ramstage-$(CONFIG_IOAPIC) += ioapic.c
diff --git a/src/arch/x86/lib/pci_ops_auto.c b/src/arch/x86/lib/pci_ops_auto.c
index 92eedd3..58e098b 100644
--- a/src/arch/x86/lib/pci_ops_auto.c
+++ b/src/arch/x86/lib/pci_ops_auto.c
@@ -6,6 +6,7 @@
#include <device/pci_ids.h>
#include <device/pci_ops.h>
+#if CONFIG_PCI_CONF2
/*
* Before we decide to use direct hardware access mechanisms, we try to do some
* trivial checks to ensure it at least _seems_ to be working -- we just test
@@ -41,7 +42,7 @@ static int pci_sanity_check(const struct pci_bus_operations *o)
return 0;
}
-struct pci_bus_operations *pci_bus_fallback_ops = NULL;
+static struct pci_bus_operations *pci_bus_fallback_ops = NULL;
static const struct pci_bus_operations *pci_check_direct(void)
{
@@ -89,6 +90,12 @@ const struct pci_bus_operations *pci_remember_direct(void)
pci_bus_fallback_ops = (struct pci_bus_operations *)pci_check_direct();
return pci_bus_fallback_ops;
}
+#else
+const struct pci_bus_operations *pci_remember_direct(void)
+{
+ return &pci_cf8_conf1;
+}
+#endif
/** Set the method to be used for PCI, type I or type II
*/
Stefan Reinauer (stefan.reinauer(a)coreboot.org) just uploaded a new patch set to gerrit, which you can find at http://review.coreboot.org/753
-gerrit
commit 63694ccc1d77e104301f11260e12aeaea643c8e7
Author: Stefan Reinauer <reinauer(a)chromium.org>
Date: Thu Nov 17 11:13:36 2011 -0800
vga_io.c is not needed unless CONFIG_VGA is set
hence disable it.
Change-Id: I7b406251a2f3830748140a111f76f2792fe923ed
Signed-off-by: Stefan Reinauer <reinauer(a)google.com>
---
src/pc80/vga/Makefile.inc | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/src/pc80/vga/Makefile.inc b/src/pc80/vga/Makefile.inc
index 0ca7896..d4b726a 100644
--- a/src/pc80/vga/Makefile.inc
+++ b/src/pc80/vga/Makefile.inc
@@ -1,4 +1,4 @@
-ramstage-y += vga_io.c
+ramstage-$(CONFIG_VGA) += vga_io.c
ramstage-$(CONFIG_VGA) += vga_palette.c
ramstage-$(CONFIG_VGA) += vga_font_8x16.c
ramstage-$(CONFIG_VGA) += vga.c