IAS boot image format is deprecated; it is recommended to use container
boot image.
- Removed references,files related to IAS image.
- Replaced IAS image boot options with container type image.
Signed-off-by: Chirag Vijay Kolhe <chirag.vijay.kolhe@intel.com>
The MULTIBOOT_MODULE type indicates the container contains only
multiboot modules and their string without a bootable kernel. Similar
to the MULTIBOOT container type, the files in container should be
organized in pairs which contains a zero-teminated text for string
and the a module binary.
This type should only be used in Extra images when Normal image is in
multiboot/multiboot2 format.
Signed-off-by: Jiaqing Zhao <jiaqing.zhao@intel.com>
* Add Name field to IMAGE_DATA structure
Add a name field to the structure to be used by container parsing
functions. It will be useful to determine the name of the container
component when dealing with special files like ACPI blobs.
Signed-off-by: Atharva Lele <atharva.lele@intel.com>
* OsLoader: save the name of the component when creating array of components
Saving the name will help us deal with special files like ACPI blobs
more easily
Signed-off-by: Atharva Lele <atharva.lele@intel.com>
* OsLoader: streamline container types
Update container functionality to streamline container types:
- Normal: PE32, FV, ELF images. Supports ACPI table update.
- Classic (Linux): Used for a traditional Linux boot setup.
(cmdline, bzImage, initrd). Additionally supports ACPI table update.
- Multiboot: Used for Multiboot/Multiboot-2 compliant ELF images.
Supports ACPI table update.
Signed-off-by: Atharva Lele <atharva.lele@intel.com>
* Rename CLASSIC container to CLASSIC_LINUX
This type of container is to be used for a traditional Linux
boot setup consisting of a cmdline, bzImage, initrd(optional),
and other binary blobs or ACPI blobs.
Rename it to CLASSIC_LINUX to make the purpose of the container
clearer.
Signed-off-by: Atharva Lele <atharva.lele@intel.com>
* OsLoader: copy Linux ExtraBlobs to reserved mem and add to cmdline
Until now, SBL loaded the Extra blobs with the Linux kernel
into memory. However, there was no way for the OS to know where
these blobs resided in memory. The blobs were also loaded in
memory that was not marked as reserved.
This patch copies the blobs to reserved memory and adds the
blob addresses into an expected placeholder in the Linux cmdline.
If the placeholder is not present, nothing related to that blob
will be added to the cmdline.
Signed-off-by: Atharva Lele <atharva.lele@intel.com>
---------
Signed-off-by: Atharva Lele <atharva.lele@intel.com>
* OsLoader: remove references to IAS images
Change IAS references to 'Boot Image' since IAS support is deprecated.
Signed-off-by: Atharva Lele <atharva.lele@intel.com>
* ContainerLib: add container type defines
Add comments to indicate the use cases of each container type
Signed-off-by: Atharva Lele <atharva.lele@intel.com>
* OsLoader: Use container defines instead of IAS defines
This commit also changes some comments referencing IAS instead of a container.
Signed-off-by: Atharva Lele <atharva.lele@intel.com>
* OsLoader: remove ParseIasImage() since it is deprecated
Remove deprecated functionality and header include.
Signed-off-by: Atharva Lele <atharva.lele@intel.com>
Signed-off-by: Chirag Vijay Kolhe <chirag.vijay.kolhe@intel.com>
* OsLoader: add check for normal container type and fix comment
NORMAL type of container is usually used with FV, regular ELF images, etc.
This commit adds the check for it and removes the "non valid use case" comment.
Signed-off-by: Atharva Lele <atharva.lele@intel.com>
* GenContainer: add comments explaining container types
Add comments explaining use cases of each container type
Signed-off-by: Atharva Lele <atharva.lele@intel.com>
* OsLoader: add a check for number of files in classic container
Classic Container needs to have the boot file in it. According
to the fixed order, this is the second file in the container.
Add a check to make sure there are atleast 2 files before attempting
boot.
Signed-off-by: Atharva Lele <atharva.lele@intel.com>
* QEMU: replace IAS references in boot options with container
Clean up IAS reference from boot options list
Signed-off-by: Atharva Lele <atharva.lele@intel.com>
Signed-off-by: Atharva Lele <atharva.lele@intel.com>
Signed-off-by: Chirag Vijay Kolhe <chirag.vijay.kolhe@intel.com>
Convert the line endings stored for all text files in the repository to
LF. The majority previously used DOS-style CRLF line endings. Add a
.gitattributes file to enforce this and treat certain extensions as
never being text files.
Update PatchCheck.py to insist on LF line endings rather than CRLF.
However, its other checks fail on this commit due to lots of
pre-existing complaints that it only notices because the line endings
have changed.
Silicon/QemuSocPkg/FspBin/Patches/0001-Build-QEMU-FSP-2.0-binaries.patch
needs to be treated as binary since it contains a mixture of line
endings.
This change has implications depending on the client platform you are
using the repository from:
* Windows
The usual configuration for Git on Windows means that text files will
be checked out to the work tree with DOS-style CRLF line endings. If
that's not the case then you can configure Git to do so for the entire
machine with:
git config --global core.autocrlf true
or for just the repository with:
git config core.autocrlf true
Line endings will be normalised to LF when they are committed to the
repository. If you commit a text file with only LF line endings then it
will be converted to CRLF line endings in your work tree.
* Linux, MacOS and other Unices
The usual configuration for Git on such platforms is to check files out
of the repository with LF line endings. This is probably the right thing
for you. In the unlikely even that you are using Git on Unix but editing
or compiling on Windows for some reason then you may need to tweak your
configuration to force the use of CRLF line endings as described above.
* General
For more information see
https://docs.github.com/en/get-started/getting-started-with-git/configuring-git-to-handle-line-endings .
Fixes: https://github.com/slimbootloader/slimbootloader/issues/1400
Signed-off-by: Mike Crowe <mac@mcrowe.com>
This patch added SBL python setup script. It can run on either host
or target MicroPython environment. A new PCD PcdEnableSetup is added
to control if Setup feature should be supported by core.
Signed-off-by: Maurice Ma <maurice.ma@intel.com>
Add support for security version check for
container and its components with ones available
in flash for capsule updates.
Signed-off-by: Subash Lakkimsetti <subash.lakkimsetti@intel.com>
Add svn field to container generation. SVN need
to be verified while doing container capsule
update. svn is added as end parameter to layout.
Signed-off-by: Subash Lakkimsetti <subash.lakkimsetti@intel.com>
This patch converted key hash store in SBL image into container
format. In this way unified data structure can be used to
simplify code.
Signed-off-by: Maurice Ma <maurice.ma@intel.com>
Current SBL supports container header verification. If the container
signature is BOOT, it will use HASH_USAGE_PUBKEY_OS. Otherwise, it
will use HASH_USAGE_PUBKEY_CONTAINER_DEF. This patch added OEM signed
container support. If a container signature between OEM0 to OEM7 is
found, it will be verified use HASH_USAGE_PUBKEY_OEM(x) where x is 0
to 7. To add an OEM public key hash, it can be done by updating
pub_key_list in GetKeyHashList() in file BoardConfig.py.
Signed-off-by: Maurice Ma <maurice.ma@intel.com>
Current container library cannot be used before memory is initialized
because the structure will only be initialized after memory. This
patch moved the initialization into Stage1A so that the library can be
used much earlier. The containers registered before memory will be
migrated into memory automatically post memory initialization. In this
way it avoids duplicated header authentication.
Signed-off-by: Maurice Ma <maurice.ma@intel.com>
Added an build config _SIGNING_SCHEME for
selection of signing schmemes. Updated tools
with param for selecting the signing scheme when
they are run in stand alone mode. Authtypes in
container are updated.
Supported Signing schemes - RSA_PCKS_1_5, RSA_PSS
Intel Crypto recommends PSS and same defaulted in
SlimBoot.
Signed-off-by: Subash Lakkimsetti <subash.lakkimsetti@intel.com>
Unified interface is added in TpmLib to extend stage and
OS Image digest. For Container OS Image this interface
is added as callback functionality. IAS image utilizes same
functionality to extend TPM digest.
Signed-off-by: Subash Lakkimsetti <subash.lakkimsetti@intel.com>
LoadComponentCallback is extended to perfom TPM extend
for firmware component stages. Component callback would be
invoked after authentication.
TpmExtendStageHash would extend hash based on hash validity.
TpmExtendConfigData is added to handle the Config data blob extend.
Signed-off-by: Subash Lakkimsetti <subash.lakkimsetti@intel.com>
Hash verification of Public key hash should be based on
hash alg used with Hash store. Previously hash alg in
signature info is used. There would be instances where
hashstore hash alg differs from signing alg.
Signed-off-by: Subash Lakkimsetti <subash.lakkimsetti@intel.com>
This will fully support PatchCheck.py.
- Remove all trailing whitespace
- Convert LF to CRLF by default
- Update EFI_D_* to DEBUG_*
- Re-enable CRLF check in PatchCheck.py
Signed-off-by: Aiden Park <aiden.park@intel.com>
Add support to load the boot image from container.
Container must be signed using the same private key
as the key used to sign IAS (i.e. IAS_PRIVATE_KEY).
Signed-off-by: Sai Talamudupula <sai.kiran.talamudupula@intel.com>
Add GetNextAvailableComponent() and authenticate the
components after registering them in CONTAINER_LIST.
Signed-off-by: Sai Talamudupula <sai.kiran.talamudupula@intel.com>
This patch enabled container use case for EPAYLOAD loading.
It also switched to use LoadComponent() API for Stage2 and
payload loading. It simplified the code flow. An example in
QEMU was added to demonstrate on how to add a container in
build and load it in Stage2 code.
To define a container layout, it is required to provide
GetContainerList() in BoardConfig.py. Then in stage or payload
code, LoadComponent() can be used to load a component from the
container.
Signed-off-by: Maurice Ma <maurice.ma@intel.com>
This patch added a ContainerLib to support load and location a
component from a specified container. It copies the component
from flash to memory, authenticate it, and then decompress it if
required. It can also be used to support load component from flash
map in SBL stage2 or payload, such as payload or e-payload.
Signed-off-by: Maurice Ma <maurice.ma@intel.com>
