From 338b83c7b840198b537427ade46c54d7ddb217b1 Mon Sep 17 00:00:00 2001 From: V Sowmya Date: Wed, 11 Nov 2020 07:04:13 +0530 Subject: [PATCH] soc/intel/common: Generate the CSE RW metadata and add to FW_MAIN_A/B In the existing implementation CSE RW metadata file is generated by scripts and to avoid incompitable issues between coreboot and the scripts this patch adds the follwing changes, * Move the metadata generation to the coreboot Makefile. * Add CBFS component type struct to create a metadata file during the compile time. * Extract the CSE RW version from SOC_INTEL_CSE_RW_VERSION config and update the major, minor, hotfix and build versions using the compile time flags. * Compute the hash of CSE RW binary in hex format using the openssl and use the HASH_BYTEARRAY macro to convert the 64 character hex values into the array. * Add the me_rw.metadata cbfs file to FW_MAIN_A and FW_MAIN_B regions. BUG=b:169077783 TEST= Built for dedede. Verify that metadata file was generated and added to the FW_MAIN_A/B. Extracted it using cbfstool and verfied that metadata was generated properly. Change-Id: I412581400a9606fa17cf4398faffda923f07b320 Signed-off-by: V Sowmya Signed-off-by: Maulik V Vaghela Reviewed-on: https://review.coreboot.org/c/coreboot/+/47431 Tested-by: build bot (Jenkins) Reviewed-by: Furquan Shaikh Reviewed-by: Karthik Ramasubramanian --- src/soc/intel/common/block/cse/Kconfig | 6 ++++ src/soc/intel/common/block/cse/Makefile.inc | 29 +++++++++++++++++ src/soc/intel/common/block/cse/cse_lite.c | 9 ------ .../intel/common/block/cse/cse_rw_metadata.c | 32 +++++++++++++++++++ .../common/block/include/intelblocks/cse.h | 19 +++++++++++ 5 files changed, 86 insertions(+), 9 deletions(-) create mode 100644 src/soc/intel/common/block/cse/cse_rw_metadata.c diff --git a/src/soc/intel/common/block/cse/Kconfig b/src/soc/intel/common/block/cse/Kconfig index a2c8928cf0..b427b15b70 100644 --- a/src/soc/intel/common/block/cse/Kconfig +++ b/src/soc/intel/common/block/cse/Kconfig @@ -41,6 +41,12 @@ config SOC_INTEL_CSE_RW_CBFS_NAME help CBFS entry name for Intel CSE CBFS RW blob +config SOC_INTEL_CSE_RW_METADATA_CBFS_NAME + string "CBFS name for CSE RW metadata file" + default "me_rw.metadata" + help + CBFS name for Intel CSE CBFS RW metadata file + config SOC_INTEL_CSE_RW_FILE string "Intel CSE CBFS RW path and filename" default "" diff --git a/src/soc/intel/common/block/cse/Makefile.inc b/src/soc/intel/common/block/cse/Makefile.inc index 11cc3c20d1..1bc69c542b 100644 --- a/src/soc/intel/common/block/cse/Makefile.inc +++ b/src/soc/intel/common/block/cse/Makefile.inc @@ -4,6 +4,7 @@ ramstage-$(CONFIG_SOC_INTEL_COMMON_BLOCK_CSE) += cse.c ramstage-$(CONFIG_SOC_INTEL_CSE_LITE_SKU) += cse_lite.c smm-$(CONFIG_SOC_INTEL_COMMON_BLOCK_HECI_DISABLE_IN_SMM) += disable_heci.c +ifeq ($(CONFIG_SOC_INTEL_CSE_RW_UPDATE),y) ifneq ($(CONFIG_SOC_INTEL_CSE_RW_FILE),"") CSE_LITE_ME_RW = $(call strip_quotes,$(CONFIG_SOC_INTEL_CSE_RW_CBFS_NAME)) regions-for-file-$(CSE_LITE_ME_RW) = FW_MAIN_A,FW_MAIN_B @@ -11,4 +12,32 @@ cbfs-files-y += $(CSE_LITE_ME_RW) $(CSE_LITE_ME_RW)-file := $(call strip_quotes,$(CONFIG_SOC_INTEL_CSE_RW_FILE)) $(CSE_LITE_ME_RW)-name := $(CSE_LITE_ME_RW) $(CSE_LITE_ME_RW)-type := raw +else +$(error "CSE RW file path is missing and need to be set by mainboard config") +endif + +# Extract the CSE RW firmware version and update the cse_rw_metadata structure +ifneq ($(CONFIG_SOC_INTEL_CSE_RW_VERSION),"") +CSE_RW_VERSION:=$(subst ., ,$(call strip_quotes,$(CONFIG_SOC_INTEL_CSE_RW_VERSION))) +MAJOR := $(word 1, $(CSE_RW_VERSION)) +MINOR := $(word 2, $(CSE_RW_VERSION)) +HOTFIX := $(word 3, $(CSE_RW_VERSION)) +BUILD := $(word 4, $(CSE_RW_VERSION)) +CPPFLAGS_common += -DCSE_RW_MAJOR=$(MAJOR) -DCSE_RW_MINOR=$(MINOR) -DCSE_RW_HOTFIX=$(HOTFIX) -DCSE_RW_BUILD=$(BUILD) +else +$(error "CSE RW version is missing and need to be set by mainboard config") +endif + +# Compute the hash of the CSE RW binary and update the cse_rw_metadata structure +CSE_RW_PATH := $(call strip_quotes,$(CONFIG_SOC_INTEL_CSE_RW_FILE)) +HASH := $(shell openssl dgst -sha256 -hex $(CSE_RW_PATH) | cut -d " " -f2 | fold -w2 | paste -sd',' -) +CPPFLAGS_common += -DCSE_RW_SHA256=$(HASH) + +# Add the CSE RW metadata file to FW_MAIN_A/B +CSE_RW_METADATA = $(call strip_quotes,$(CONFIG_SOC_INTEL_CSE_RW_METADATA_CBFS_NAME)) +regions-for-file-$(CSE_RW_METADATA) = FW_MAIN_A,FW_MAIN_B +cbfs-files-y += $(CSE_RW_METADATA) +$(CSE_RW_METADATA)-file := cse_rw_metadata.c:struct +$(CSE_RW_METADATA)-name := $(CSE_RW_METADATA) +$(CSE_RW_METADATA)-type := raw endif diff --git a/src/soc/intel/common/block/cse/cse_lite.c b/src/soc/intel/common/block/cse/cse_lite.c index edb35c4353..39f2cda4c1 100644 --- a/src/soc/intel/common/block/cse/cse_lite.c +++ b/src/soc/intel/common/block/cse/cse_lite.c @@ -9,7 +9,6 @@ #include #include #include -#include #include /* CSE RW version size reserved in the CSE CBFS RW binary */ @@ -110,14 +109,6 @@ enum bp_info_flags { BP_INFO_READ_ONLY_CFG = 1 << 2, }; -/* Boot Partition FW Version */ -struct fw_version { - uint16_t major; - uint16_t minor; - uint16_t hotfix; - uint16_t build; -} __packed; - /* CSE boot partition entry info */ struct cse_bp_entry { /* Boot partition version */ diff --git a/src/soc/intel/common/block/cse/cse_rw_metadata.c b/src/soc/intel/common/block/cse/cse_rw_metadata.c new file mode 100644 index 0000000000..3f7e779907 --- /dev/null +++ b/src/soc/intel/common/block/cse/cse_rw_metadata.c @@ -0,0 +1,32 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ + +#include + +#define HASH_TO_ARRAY(x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15, x16,\ + x17, x18, x19, x20, x21, x22, x23, x24, x25, x26, x27, x28, x29, x30,\ + x31, x32) { 0x##x1, 0x##x2, 0x##x3, 0x##x4, 0x##x5, 0x##x6, 0x##x7,\ + 0x##x8, 0x##x9, 0x##x10, 0x##x11, 0x##x12, 0x##x13, 0x##x14, 0x##x15,\ + 0x##x16, 0x##x17, 0x##x18, 0x##x19, 0x##x20, 0x##x21, 0x##x22, 0x##x23,\ + 0x##x24, 0x##x25, 0x##x26, 0x##x27, 0x##x28, 0x##x29, 0x##x30, 0x##x31,\ + 0x##x32 } +#define HASH_BYTEARRAY(...) HASH_TO_ARRAY(__VA_ARGS__) + +/* + * This structure contains the CSE RW version and hash details which are filled during the + * compile time. + * Makefile will extract the following details and updates the structure variable via the + * compile time flags. + * CSE RW version: Extract the version string from the SOC_INTEL_CSE_RW_VERSION config and + * assign the major, minor, hotfix and build versions. + * CSE RW hash: Compute the hash of CSE RW binary in hex format using the openssl and use the + * HASH_BYTEARRAY macro to convert the 64 character hex values into the array. + */ +struct cse_rw_metadata metadata = { + .version = { + .major = CSE_RW_MAJOR, + .minor = CSE_RW_MINOR, + .build = CSE_RW_BUILD, + .hotfix = CSE_RW_HOTFIX, + }, + .sha256 = HASH_BYTEARRAY(CSE_RW_SHA256), +}; diff --git a/src/soc/intel/common/block/include/intelblocks/cse.h b/src/soc/intel/common/block/include/intelblocks/cse.h index f554933ef4..64ee0ddd06 100644 --- a/src/soc/intel/common/block/include/intelblocks/cse.h +++ b/src/soc/intel/common/block/include/intelblocks/cse.h @@ -4,6 +4,7 @@ #define SOC_INTEL_COMMON_CSE_H #include +#include /* MKHI Command groups */ #define MKHI_GROUP_ID_CBM 0x0 @@ -61,6 +62,24 @@ struct mkhi_hdr { uint8_t result; } __packed; +/* CSE FW Version */ +struct fw_version { + uint16_t major; + uint16_t minor; + uint16_t hotfix; + uint16_t build; +} __packed; + +/* + * CSE RW metadata structure + * fw_version - CSE RW firmware version + * sha256 - Hash of the CSE RW binary. + */ +struct cse_rw_metadata { + struct fw_version version; + uint8_t sha256[VB2_SHA256_DIGEST_SIZE]; +}; + /* set up device for use in early boot enviroument with temp bar */ void heci_init(uintptr_t bar); /*