GNUBoot
/
coreboot-kgpe-d16
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
coreboot-kgpe-d16/Documentation/mainboard/lenovo/vboot.md

39 lines
1.7 KiB
Markdown
Raw Normal View History

Documentation: Add vboot on Lenovo devices Describe vboot implementation details for retrofitted Lenovo ThinkPad devices. Change-Id: Ibabcc939d9d01f00a93fd42adc48057966ad877e Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Signed-off-by: Marcello Sylvester Bauer <sylv@sylv.io> Reviewed-on: https://review.coreboot.org/c/coreboot/+/39151 Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net> Reviewed-by: Patrick Rudolph <siro@das-labor.org> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2020-02-27 14:55:50 +01:00
# Using coreboot's verified boot on Lenovo devices
By default a single instance of coreboot is present in the firmware flash,
no verification is done and the flash is not write-protected, so as to allow
firmware updates from the OS.
Documentation: Spell vboot all lowercase Update all occurrences of vboot and spell it lowercase. Change-Id: I432b0db8a3dda43b71844e557a3d89180f25f1c3 Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Signed-off-by: Marcello Sylvester Bauer <sylv@sylv.io> Reviewed-on: https://review.coreboot.org/c/coreboot/+/39799 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Patrick Georgi <pgeorgi@google.com>
2020-03-24 08:40:45 +01:00
The verified boot mechanism also called [vboot] allows secure firmware
Documentation: Add vboot on Lenovo devices Describe vboot implementation details for retrofitted Lenovo ThinkPad devices. Change-Id: Ibabcc939d9d01f00a93fd42adc48057966ad877e Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Signed-off-by: Marcello Sylvester Bauer <sylv@sylv.io> Reviewed-on: https://review.coreboot.org/c/coreboot/+/39151 Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net> Reviewed-by: Patrick Rudolph <siro@das-labor.org> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2020-02-27 14:55:50 +01:00
updates using an A/B partitioning scheme once enabled.
Documentation: Spell vboot all lowercase Update all occurrences of vboot and spell it lowercase. Change-Id: I432b0db8a3dda43b71844e557a3d89180f25f1c3 Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Signed-off-by: Marcello Sylvester Bauer <sylv@sylv.io> Reviewed-on: https://review.coreboot.org/c/coreboot/+/39799 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Patrick Georgi <pgeorgi@google.com>
2020-03-24 08:40:45 +01:00
## Enabling vboot
You can enable [vboot] in Kconfig's *Security* section. Besides a verified
Documentation: Add vboot on Lenovo devices Describe vboot implementation details for retrofitted Lenovo ThinkPad devices. Change-Id: Ibabcc939d9d01f00a93fd42adc48057966ad877e Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Signed-off-by: Marcello Sylvester Bauer <sylv@sylv.io> Reviewed-on: https://review.coreboot.org/c/coreboot/+/39151 Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net> Reviewed-by: Patrick Rudolph <siro@das-labor.org> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2020-02-27 14:55:50 +01:00
boot you can also enable a measured boot by setting
`CONFIG_VBOOT_MEASURED_BOOT`. Both options need a working TPM, which is
present on all recent Lenovo devices.
## Updating and recovery
As the A/B partition is writeable you can still update them from the OS.
Documentation: Spell vboot all lowercase Update all occurrences of vboot and spell it lowercase. Change-Id: I432b0db8a3dda43b71844e557a3d89180f25f1c3 Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Signed-off-by: Marcello Sylvester Bauer <sylv@sylv.io> Reviewed-on: https://review.coreboot.org/c/coreboot/+/39799 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Patrick Georgi <pgeorgi@google.com>
2020-03-24 08:40:45 +01:00
By using the [vboot] mechanism you store a copy of coreboot in the `RO`
Documentation: Add vboot on Lenovo devices Describe vboot implementation details for retrofitted Lenovo ThinkPad devices. Change-Id: Ibabcc939d9d01f00a93fd42adc48057966ad877e Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Signed-off-by: Marcello Sylvester Bauer <sylv@sylv.io> Reviewed-on: https://review.coreboot.org/c/coreboot/+/39151 Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net> Reviewed-by: Patrick Rudolph <siro@das-labor.org> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2020-02-27 14:55:50 +01:00
partition that acts as failsafe in case the regular firmware update, that
goes to the `A` or `B` partition fails.
Documentation: Update vboot on lenovo Update the documentation now that CB:32705 is merged. Change-Id: I9845c0750ec4016188478154610400d1b8556793 Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/40775 Reviewed-by: Marcello Sylvester Bauer <sylv@sylv.io> Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net> Reviewed-by: Patrick Georgi <pgeorgi@google.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2020-04-28 08:06:34 +02:00
**Note:** The `RO` partition isn't write-protected by default, therefore you
have to enable the protection in the security Kconfig menu by yourself.
Documentation: Add vboot on Lenovo devices Describe vboot implementation details for retrofitted Lenovo ThinkPad devices. Change-Id: Ibabcc939d9d01f00a93fd42adc48057966ad877e Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Signed-off-by: Marcello Sylvester Bauer <sylv@sylv.io> Reviewed-on: https://review.coreboot.org/c/coreboot/+/39151 Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net> Reviewed-by: Patrick Rudolph <siro@das-labor.org> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2020-02-27 14:55:50 +01:00
On *Lenovo* devices you can enable the *Fn* key as recovery mode switch, by
enabling `CONFIG_H8_FN_KEY_AS_VBOOT_RECOVERY_SW`.
Holding the *Fn* at boot will then switch to the recovery image, allowing
to boot and flash a working image to the A/B partition.
## 8 MiB ROM limitation
*Lenovo* devices with 8 MiB ROM only have a `RO`+`A` partition enabled in the
default FMAP. They are missing the `B` partition, due to size constaints.
You can still provide your own FMAP if you need `RO`+`A`+`B` partitions.
## CMOS
Documentation: Spell vboot all lowercase Update all occurrences of vboot and spell it lowercase. Change-Id: I432b0db8a3dda43b71844e557a3d89180f25f1c3 Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Signed-off-by: Marcello Sylvester Bauer <sylv@sylv.io> Reviewed-on: https://review.coreboot.org/c/coreboot/+/39799 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Patrick Georgi <pgeorgi@google.com>
2020-03-24 08:40:45 +01:00
[vboot] on *Lenovo* devices uses the CMOS to store configuration data, like
Documentation: Add vboot on Lenovo devices Describe vboot implementation details for retrofitted Lenovo ThinkPad devices. Change-Id: Ibabcc939d9d01f00a93fd42adc48057966ad877e Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Signed-off-by: Marcello Sylvester Bauer <sylv@sylv.io> Reviewed-on: https://review.coreboot.org/c/coreboot/+/39151 Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net> Reviewed-by: Patrick Rudolph <siro@das-labor.org> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2020-02-27 14:55:50 +01:00
boot failures and the last successfully booted partition.
Documentation: Spell vboot all lowercase Update all occurrences of vboot and spell it lowercase. Change-Id: I432b0db8a3dda43b71844e557a3d89180f25f1c3 Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com> Signed-off-by: Marcello Sylvester Bauer <sylv@sylv.io> Reviewed-on: https://review.coreboot.org/c/coreboot/+/39799 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Patrick Georgi <pgeorgi@google.com>
2020-03-24 08:40:45 +01:00
[vboot]: ../../security/vboot/index.md