Currently SBL supports SMM REBASE based on configuration.
1) When payload doesn't support SMM, SBL need enable SMM rebase.
So SBL will rebase SMM to SMRAM and set SMRR to prevent SMRAM
access out of SMM and prevent payload SMM driver dispatch.
2) When payload support SMM, SBL need disable SMM rebase.
In this case SBL do nothing for SMM. Payload will do SMM
rebase.
In new UEFI payload (after stable branch 202311), SMM relocation
was removed CPU SMM driver. To work with new UEFI payload, SMM
relocation is expected in SBL, but SMRR should not be set so that
SMM drivers in UEFI payload could be dispatched into SMRAM.
This patch adds a new SMM rebase configuration that it rebase SMM
but it doesn't set SMRR.
Currently SBL supports rebase AUTO setting based on payload. This
patch also add auto support.
Signed-off-by: Guo Dong <guo.dong@intel.com>
library
Migrates FW resiliency APIs of Stage1B.c to
FirmwareResiliencyLib
Migrates FW update status types from FirmwareUpdateLib.h and
BootloaderCommonLib.h to FirmwareUpdateStatus.h
Signed-off-by: Sean McGinn <sean.mcginn@intel.com>
If TS bit flipped and it does not match FWU state,
assume ACM detected corruption in SG1A or SG1B and
recover broken BP
Add WDT trigger for recovery
Add ADL-specific WDT trigger for TS
Signed-off-by: Sean McGinn <sean.mcginn@intel.com>
Convert the line endings stored for all text files in the repository to
LF. The majority previously used DOS-style CRLF line endings. Add a
.gitattributes file to enforce this and treat certain extensions as
never being text files.
Update PatchCheck.py to insist on LF line endings rather than CRLF.
However, its other checks fail on this commit due to lots of
pre-existing complaints that it only notices because the line endings
have changed.
Silicon/QemuSocPkg/FspBin/Patches/0001-Build-QEMU-FSP-2.0-binaries.patch
needs to be treated as binary since it contains a mixture of line
endings.
This change has implications depending on the client platform you are
using the repository from:
* Windows
The usual configuration for Git on Windows means that text files will
be checked out to the work tree with DOS-style CRLF line endings. If
that's not the case then you can configure Git to do so for the entire
machine with:
git config --global core.autocrlf true
or for just the repository with:
git config core.autocrlf true
Line endings will be normalised to LF when they are committed to the
repository. If you commit a text file with only LF line endings then it
will be converted to CRLF line endings in your work tree.
* Linux, MacOS and other Unices
The usual configuration for Git on such platforms is to check files out
of the repository with LF line endings. This is probably the right thing
for you. In the unlikely even that you are using Git on Unix but editing
or compiling on Windows for some reason then you may need to tweak your
configuration to force the use of CRLF line endings as described above.
* General
For more information see
https://docs.github.com/en/get-started/getting-started-with-git/configuring-git-to-handle-line-endings .
Fixes: https://github.com/slimbootloader/slimbootloader/issues/1400
Signed-off-by: Mike Crowe <mac@mcrowe.com>
For non UEFI payload, SBL will install dummy SMI handler for
security concern. For UEFI payload, SMM rebasing is expected
to be done itself. This patch enabled this feature for APL and
CFL platform.
Signed-off-by: Maurice Ma <maurice.ma@intel.com>
Currently SBL library has GetDeviceAddr() to get the device
address based on device type and instance. This patch adds
SetDeviceAddr() to update a given device type and address so
that platform could update the device table dynamically.
Signed-off-by: Guo Dong <guo.dong@intel.com>
This patch moved GetHashToExtend function from BootloaderCommonLib
to SecureBootLib. It is a better place to contain this interface.
Signed-off-by: Maurice Ma <maurice.ma@intel.com>
Add svn field to container generation. SVN need
to be verified while doing container capsule
update. svn is added as end parameter to layout.
Signed-off-by: Subash Lakkimsetti <subash.lakkimsetti@intel.com>
* [QEMU] Enable Stage1A boot in X64 mode
This patch added necessary changes to enable QEMU boot through
Stage1A in SBL X64 build.
Signed-off-by: Maurice Ma <maurice.ma@intel.com>
* [QEMU] Enable QEMU Linux boot in X64 mode
This patch enabled SBL X64 boot for Linux. At this moment, since
FSP is still in 32 bit mode, it is required to thunk back into
32 bit mode to call FSP APIs.
It fixed#622.
Signed-off-by: Maurice Ma <maurice.ma@intel.com>
There are lots of common code in Stage1A/1B/2, so it makes sense
to put those into a StageLib so that the same code can be reused.
As part of it, PagingLib is also restructured to align with Stage
mapping/remapping. It will consider both X64 mode and IA32 mode.
Signed-off-by: Maurice Ma <maurice.ma@intel.com>
This patch allows both 32/64-bit addressing properly.
- Pointer type cast with UINTN
- Add missing EFIAPI for APIs
Signed-off-by: Aiden Park <aiden.park@intel.com>
This patch opitmized GDT loading in different stages. The old code
put GDT in code segment so it needs to be relocated every time when
code relocation/remapping occurs. By putting GDT into heap, it avoids
the GDT reloading. It only needs to be done twice, PreMem and PostMem.
Signed-off-by: Maurice Ma <maurice.ma@intel.com>
Unified interface is added in TpmLib to extend stage and
OS Image digest. For Container OS Image this interface
is added as callback functionality. IAS image utilizes same
functionality to extend TPM digest.
Signed-off-by: Subash Lakkimsetti <subash.lakkimsetti@intel.com>
- Added GetHashToExtend to bootloader common API to
retrive digest to extend
- Hash calculations for stage component and config date updated
to use bootloader common API
- Added functionality to extend KeyHashManifest digest
Signed-off-by: Subash Lakkimsetti <subash.lakkimsetti@intel.com>
This patch added routine to get component entry from flash map
this is required in case when component entry flags are required.
GetComponentInfoByPartition function will reuse the newly added
routine GetComponentEntryByPartition.
Signed-off-by: Raghava Gudla <raghava.gudla@intel.com>
Current SBL hash store has many limitations:
- Only support fixed hash size
- Only support 1:1 public key and usage mapping
- Only support build time key enrollment
This patch addressed this issue by introducing:
- Add a updatable KEYH component to hold extra key hash
- Allow append new hash entries from KEYH
- Use variable length entry for hash
- Introduce "Usage" bit mask for a key usage
This will allow using a single key to sign multiple components, or
using multiple keys to sign a single component. The built-in hash
store will only contain hash for STAGE1B, STAGE2, PAYLOAD,
PAYLOAD_FWU and MASTER public key hash. Master key hash will be used
to verify the KEYH component loaded at runtime in Stage1B. Once KEYH
is loaded, it will be appended into global hash store. The combined
hash store will be used to verify other components on the boot flow.
Signed-off-by: Maurice Ma <maurice.ma@intel.com>
This patch moved some library APIs into BootloaderCommonLib, including
GetComponentInfo() and GetComponentHash().
Signed-off-by: Maurice Ma <maurice.ma@intel.com>
HASH_STORE_TABLE is updated and HASH_STORE_DATA is added
to provide info with variable length sizes. Usage bits would
notify for multiple component/key using the same hash.
These data structure would optimize the hash store size
in storage.
PcdHashStoreSize would define the size of Hash store
to allocate in bios bootup.
Signed-off-by: Subash Lakkimsetti <subashx.lakkimsetti@intel.com>
Component Hash is passed with TpmExtendHash if available.
Hash Store is getting optimized on storage and this would avoid
setting component hash in hash table. SetComponent Hash API is
removed in bootloaderlib.
Added HashAlg param to TpmExtendHash for future purposes
where TPM PCR bank would be selected based on HashAlg.
Signed-off-by: Subash Lakkimsetti <subashx.lakkimsetti@intel.com>
This will fully support PatchCheck.py.
- Remove all trailing whitespace
- Convert LF to CRLF by default
- Update EFI_D_* to DEBUG_*
- Re-enable CRLF check in PatchCheck.py
Signed-off-by: Aiden Park <aiden.park@intel.com>
OsLoader has the capability to boot a Linux kernel. However, to support
LinuxBoot type of payload, it is required to load kernel in Stage2. This
patch abstracts the standard Linux loading logic into common LinuxLib
class so that it can be linked in Stage2 or Payload such as OsLoader.
A new PcdLinuxPayloadEnabled is introduced to control if this feature
should be enabled or not.
To boot a Linux kernel from Stage2, it is required to put the command
line file and kernel image into the EPAYLOAD container during the build.
And the PayloadId CFGDATA needs to be set to 'LINX'.
For example:
python BuildLoader.py build qemu
-p OsLoader.efi::Lz4;vmlinuz:LINX:Dummy;cmdline.txt:CMDL:Dummy
vmlinuz and cmdkube.txt need to be copied to PayloadPkg/PayloadBins
folder. If kernel size cannot fit into EPAYLOAD, EPAYLOAD_SIZE in
BoardConfig.py needs to be adjusted accordingly.
Signed-off-by: Maurice Ma <maurice.ma@intel.com>
This patch added a ContainerLib to support load and location a
component from a specified container. It copies the component
from flash to memory, authenticate it, and then decompress it if
required. It can also be used to support load component from flash
map in SBL stage2 or payload, such as payload or e-payload.
Signed-off-by: Maurice Ma <maurice.ma@intel.com>
Guo Dong
Antara Borwankar
Sean McGinn
Mike Crowe
Maurice Ma
Subash Lakkimsetti
Aiden Park
Subash Lakkimsetti
Raghava Gudla
Subash Lakkimsetti