| Message ID | 1517883394-27073-3-git-send-email-ppaidipe@linux.vnet.ibm.com |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [1/3] libstb: fix failure of calling cvc verify without STB initialization. | expand |
On 02/06/2018 07:46 AM, Pridhiviraj Paidipeddi wrote: > As a safer side move the imc catalog preload after the STB init > to make sure the imc catalog resource get's verified and measured > properly during loading when both secure and trusted boot modes > are on. > > Signed-off-by: Pridhiviraj Paidipeddi <ppaidipe@linux.vnet.ibm.com> > --- > core/init.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/core/init.c b/core/init.c > index ec9f329..6eb4d83 100644 > --- a/core/init.c > +++ b/core/init.c > @@ -997,9 +997,6 @@ void __noreturn __nomcount main_cpu_entry(const void *fdt) > /* Read in NVRAM and set it up */ > nvram_init(); > > - /* preload the IMC catalog dtb */ > - imc_catalog_preload(); > - > /* Set the console level */ > console_log_level(); > > @@ -1007,6 +1004,9 @@ void __noreturn __nomcount main_cpu_entry(const void *fdt) > secureboot_init(); > trustedboot_init(); Can we initialize secureboot before platform init ? That would solve all the issues. -Vasant
Vasant Hegde <hegdevasant@linux.vnet.ibm.com> writes: > On 02/06/2018 07:46 AM, Pridhiviraj Paidipeddi wrote: >> As a safer side move the imc catalog preload after the STB init >> to make sure the imc catalog resource get's verified and measured >> properly during loading when both secure and trusted boot modes >> are on. >> >> Signed-off-by: Pridhiviraj Paidipeddi <ppaidipe@linux.vnet.ibm.com> >> --- >> core/init.c | 6 +++--- >> 1 file changed, 3 insertions(+), 3 deletions(-) >> >> diff --git a/core/init.c b/core/init.c >> index ec9f329..6eb4d83 100644 >> --- a/core/init.c >> +++ b/core/init.c >> @@ -997,9 +997,6 @@ void __noreturn __nomcount main_cpu_entry(const void *fdt) >> /* Read in NVRAM and set it up */ >> nvram_init(); >> >> - /* preload the IMC catalog dtb */ >> - imc_catalog_preload(); >> - >> /* Set the console level */ >> console_log_level(); >> >> @@ -1007,6 +1004,9 @@ void __noreturn __nomcount main_cpu_entry(const void *fdt) >> secureboot_init(); >> trustedboot_init(); > > Can we initialize secureboot before platform init ? That would solve > all the issues. Probably? Maybe? I wonder if we have / may have any quirks though...
On 2018-02-09 10:35, Stewart Smith wrote: > Vasant Hegde <hegdevasant@linux.vnet.ibm.com> writes: >> On 02/06/2018 07:46 AM, Pridhiviraj Paidipeddi wrote: >>> As a safer side move the imc catalog preload after the STB init >>> to make sure the imc catalog resource get's verified and measured >>> properly during loading when both secure and trusted boot modes >>> are on. >>> >>> Signed-off-by: Pridhiviraj Paidipeddi <ppaidipe@linux.vnet.ibm.com> >>> --- >>> core/init.c | 6 +++--- >>> 1 file changed, 3 insertions(+), 3 deletions(-) >>> >>> diff --git a/core/init.c b/core/init.c >>> index ec9f329..6eb4d83 100644 >>> --- a/core/init.c >>> +++ b/core/init.c >>> @@ -997,9 +997,6 @@ void __noreturn __nomcount main_cpu_entry(const >>> void *fdt) >>> /* Read in NVRAM and set it up */ >>> nvram_init(); >>> >>> - /* preload the IMC catalog dtb */ >>> - imc_catalog_preload(); >>> - >>> /* Set the console level */ >>> console_log_level(); >>> >>> @@ -1007,6 +1004,9 @@ void __noreturn __nomcount main_cpu_entry(const >>> void *fdt) >>> secureboot_init(); >>> trustedboot_init(); >> >> Can we initialize secureboot before platform init ? That would solve >> all the issues. > > Probably? Maybe? > > I wonder if we have / may have any quirks though... I checked that, STB init depends on nvram_init, which again depends on pnor_init, which we are doing currently it in platform init, so moving it above platform init has lot of dependencies. So i have come up with this fix by re-orderings inits to do verify and measure best out of it. https://lists.ozlabs.org/pipermail/skiboot/2018-February/010430.html But we have a dependency issue is there for this fix, which needs to be resolved first before this patch merges, otherwise we will be having boot abort failure in secure mode enabled systems. https://github.com/open-power/op-build/issues/1849
diff --git a/core/init.c b/core/init.c index ec9f329..6eb4d83 100644 --- a/core/init.c +++ b/core/init.c @@ -997,9 +997,6 @@ void __noreturn __nomcount main_cpu_entry(const void *fdt) /* Read in NVRAM and set it up */ nvram_init(); - /* preload the IMC catalog dtb */ - imc_catalog_preload(); - /* Set the console level */ console_log_level(); @@ -1007,6 +1004,9 @@ void __noreturn __nomcount main_cpu_entry(const void *fdt) secureboot_init(); trustedboot_init(); + /* preload the IMC catalog dtb */ + imc_catalog_preload(); + /* Install the OPAL Console handlers */ init_opal_console();
As a safer side move the imc catalog preload after the STB init to make sure the imc catalog resource get's verified and measured properly during loading when both secure and trusted boot modes are on. Signed-off-by: Pridhiviraj Paidipeddi <ppaidipe@linux.vnet.ibm.com> --- core/init.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)