From patchwork Tue Jul 10 06:25:32 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sam Mendoza-Jonas X-Patchwork-Id: 941816 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.ozlabs.org (lists.ozlabs.org [203.11.71.2]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 41Psf52YSkz9s1R for ; Tue, 10 Jul 2018 16:26:05 +1000 (AEST) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=mendozajonas.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=mendozajonas.com header.i=@mendozajonas.com header.b="IJkc8L6Y"; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=messagingengine.com header.i=@messagingengine.com header.b="cLx2ojO9"; dkim-atps=neutral Received: from lists.ozlabs.org (lists.ozlabs.org [IPv6:2401:3900:2:1::3]) by lists.ozlabs.org (Postfix) with ESMTP id 41Psf50wsbzDrcC for ; Tue, 10 Jul 2018 16:26:05 +1000 (AEST) Authentication-Results: lists.ozlabs.org; dmarc=none (p=none dis=none) header.from=mendozajonas.com Authentication-Results: lists.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=mendozajonas.com header.i=@mendozajonas.com header.b="IJkc8L6Y"; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=messagingengine.com header.i=@messagingengine.com header.b="cLx2ojO9"; dkim-atps=neutral X-Original-To: skiboot@lists.ozlabs.org Delivered-To: skiboot@lists.ozlabs.org Authentication-Results: lists.ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=mendozajonas.com (client-ip=66.111.4.25; helo=out1-smtp.messagingengine.com; envelope-from=sam@mendozajonas.com; receiver=) Authentication-Results: lists.ozlabs.org; dmarc=none (p=none dis=none) header.from=mendozajonas.com Authentication-Results: lists.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=mendozajonas.com header.i=@mendozajonas.com header.b="IJkc8L6Y"; dkim=pass (2048-bit key; unprotected) header.d=messagingengine.com header.i=@messagingengine.com header.b="cLx2ojO9"; dkim-atps=neutral Received: from out1-smtp.messagingengine.com (out1-smtp.messagingengine.com [66.111.4.25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 41Psdv4qnwzDrTn for ; Tue, 10 Jul 2018 16:25:55 +1000 (AEST) Received: from compute2.internal (compute2.nyi.internal [10.202.2.42]) by mailout.nyi.internal (Postfix) with ESMTP id C33D321E97; Tue, 10 Jul 2018 02:25:50 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute2.internal (MEProxy); Tue, 10 Jul 2018 02:25:50 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= mendozajonas.com; h=cc:date:from:message-id:subject:to :x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=k9IEVyrEtvwkfVfv4 JRszTTroLntROGioDi4fn/ccDQ=; b=IJkc8L6YNFSq7EWJ1/8nysyBHzHwwShJV wZV/4QbyBJkiC9pce/gNmcjVPYNGi3O2G4y/CgxUs0bgNr2tJyOaQBFk6CEjO863 6u8OxY6E1mxFnxqgyd2fmYuY5/Wg4J3HTa+26wspS61XBQYq0FMGP8wYqmFuSjt2 yo4vCQu2bLQzJq+vHK9ccwB0J23KoVY1v41NkGeGknx7KqiYJuAFaiErEyVMpTxl 0bY+FFvYeaJ94CbqHGt2WsAIboC8P8mr7VF8tqpk+dAYBY5krs+TNjO2xbZ+Wm5C tdGoxQ+/qNlCP/Z5Wv8WpC5u+SKTYVKRWtmCBw/4kBzqdPzALA/gg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:date:from:message-id:subject:to :x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=k9IEVyrEtvwkfVfv4 JRszTTroLntROGioDi4fn/ccDQ=; b=cLx2ojO9kuJC3WbZ7Hl4kGKEU2/Kr/TJU HBCo7Sc1pqom4p1xYvhCG93Q7FGvj80Ku5ZKUlFDXuAjs0f+qDMU58kSBmQDDTsG BxCkD7DPcLXDH9DHRuGYgGE5PgfAAvY3+12NOELE+ImbUCThsWl4uqWxlfMomRi3 LLc7H7oQo25+QLEx3QYNA/vxgbrefj44GDuRylf6rmVDRKENyVhdV82LkyYb+2N5 QggkbKz9sSirB5jlq/i4qNZILbi42+YXXdyRn31FVi8sg+e/CSwZHGgse431XRqa p/t+21RlKXK6/olMQ40DQV9rArlHx8+b5X9Y/yAxUrUOUx6MoEEag== X-ME-Proxy: X-ME-Sender: Received: from v4.ozlabs.ibm.com (unknown [122.99.82.10]) by mail.messagingengine.com (Postfix) with ESMTPA id 32A6610269; Tue, 10 Jul 2018 02:25:48 -0400 (EDT) From: Samuel Mendoza-Jonas To: skiboot@lists.ozlabs.org Date: Tue, 10 Jul 2018 16:25:32 +1000 Message-Id: <20180710062532.15854-1-sam@mendozajonas.com> X-Mailer: git-send-email 2.18.0 Subject: [Skiboot] [PATCH v2] Recognise signed VERSION partition X-BeenThere: skiboot@lists.ozlabs.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: Mailing list for skiboot development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Samuel Mendoza-Jonas MIME-Version: 1.0 Errors-To: skiboot-bounces+incoming=patchwork.ozlabs.org@lists.ozlabs.org Sender: "Skiboot" A few things need to change to support a signed VERSION partition: - A signed VERSION partition will be 4K + SECURE_BOOT_HEADERS_SIZE (4K). - The VERSION partition needs to be loaded after secure/trusted boot is set up, and therefore after nvram_init(). - Added to the trustedboot resources array. This also moves the ipmi_dt_add_bmc_info() call to after flash_dt_add_fw_version() since it adds info to ibm,firmware-versions. Signed-off-by: Samuel Mendoza-Jonas --- v2: rebase on master to work alongside the flash_dt_add_fw_version() changes, move modifying the DT to later in the boot process and let VERSION load in the background. core/flash.c | 4 +++- core/init.c | 13 +++++++++++++ libstb/trustedboot.c | 1 + platforms/astbmc/common.c | 9 --------- 4 files changed, 17 insertions(+), 10 deletions(-) diff --git a/core/flash.c b/core/flash.c index e3be5761..e258fe17 100644 --- a/core/flash.c +++ b/core/flash.c @@ -51,7 +51,7 @@ static u32 nvram_offset, nvram_size; /* ibm,firmware-versions support */ static char *version_buf; -static size_t version_buf_size = 0x1000; +static size_t version_buf_size = 0x2000; bool flash_reserve(void) { @@ -235,6 +235,8 @@ void flash_dt_add_fw_version(void) fw_version = dt_new(dt_root, "ibm,firmware-versions"); assert(fw_version); + if (stb_is_container(version_buf, version_buf_size)) + numbytes += SECURE_BOOT_HEADERS_SIZE; for ( ; (numbytes < version_buf_size) && version_buf[numbytes]; numbytes++) { if (version_buf[numbytes] == '\n') { version_data[i] = '\0'; diff --git a/core/init.c b/core/init.c index b660af2d..ca6c468c 100644 --- a/core/init.c +++ b/core/init.c @@ -1070,6 +1070,13 @@ void __noreturn __nomcount main_cpu_entry(const void *fdt) secureboot_init(); trustedboot_init(); + /* + * BMC platforms load version information from flash after + * secure/trustedboot init. + */ + if (platform.bmc) + flash_fw_version_preload(); + /* preload the IMC catalog dtb */ imc_catalog_preload(); @@ -1128,6 +1135,12 @@ void __noreturn __nomcount main_cpu_entry(const void *fdt) /* Add OPAL timer related properties */ late_init_timers(); + /* Setup ibm,firmware-versions if able */ + if (platform.bmc) { + flash_dt_add_fw_version(); + ipmi_dt_add_bmc_info(); + } + ipmi_set_fw_progress_sensor(IPMI_FW_PCI_INIT); /* diff --git a/libstb/trustedboot.c b/libstb/trustedboot.c index 8fa11790..ae2cc556 100644 --- a/libstb/trustedboot.c +++ b/libstb/trustedboot.c @@ -46,6 +46,7 @@ static struct { { RESOURCE_ID_IMA_CATALOG, PCR_2 }, { RESOURCE_ID_KERNEL, PCR_4 }, { RESOURCE_ID_CAPP, PCR_2 }, + { RESOURCE_ID_VERSION, PCR_3 }, }; /* diff --git a/platforms/astbmc/common.c b/platforms/astbmc/common.c index aa278a03..6c90b7db 100644 --- a/platforms/astbmc/common.c +++ b/platforms/astbmc/common.c @@ -134,9 +134,6 @@ void astbmc_init(void) astbmc_fru_init(); ipmi_sensor_init(); - /* Preload PNOR VERSION section */ - flash_fw_version_preload(); - /* Request BMC information */ ipmi_get_bmc_info_request(); @@ -150,12 +147,6 @@ void astbmc_init(void) /* Setup UART console for use by Linux via OPAL API */ set_opal_console(&uart_opal_con); - - /* Add ibm,firmware-versions node */ - flash_dt_add_fw_version(); - - /* Add BMC firmware info to device tree */ - ipmi_dt_add_bmc_info(); } int64_t astbmc_ipmi_power_down(uint64_t request)