[Skiboot] [PATCH v2] Recognise signed VERSION partition

[ppaidipe]

On 2018-07-17 13:36, Stewart Smith wrote:
> Samuel Mendoza-Jonas <sam at mendozajonas.com> writes:
>> A few things need to change to support a signed VERSION partition:
>> 
>> - A signed VERSION partition will be 4K + SECURE_BOOT_HEADERS_SIZE 
>> (4K).
>> - The VERSION partition needs to be loaded after secure/trusted boot 
>> is
>>   set up, and therefore after nvram_init().
>> - Added to the trustedboot resources array.
>> 
>> This also moves the ipmi_dt_add_bmc_info() call to after
>> flash_dt_add_fw_version() since it adds info to ibm,firmware-versions.
>> 
>> Signed-off-by: Samuel Mendoza-Jonas <sam at mendozajonas.com>
>> ---
>> v2: rebase on master to work alongside the flash_dt_add_fw_version()
>> changes, move modifying the DT to later in the boot process and let
>> VERSION load in the background.
> 
> looks good to me, merged to master as of
> 3cd749c99791d43ee929b9401fb14fc6739ce360


On secureboot enabled platforms we are getting a boot enforce with this 
patch
as VERSION partition is still not signed.

[   74.044712556,7] LPC: Routing irq 4, policy: 0 (r=1)
[   74.044713816,7] LPC: SerIRQ 4 using route 2 targetted at OPAL
[   74.049822308,5] OCC: All Chip Rdy after 0 ms
[   74.252505689,0] STB: VERSION verification FAILED. 
log=0xffffffffffff8120
[   74.255402552,0] STB: secure mode enforced, aborting.
[   74.258240099,0] Aborting!
CPU 0018 Backtrace:
  S: 0000000031cc3a60 R: 000000003001ae60   ._abort+0x4c
  S: 0000000031cc3ae0 R: 00000000300a8a40   .secureboot_enforce+0x3c
  S: 0000000031cc3b50 R: 00000000300a8f50   .secureboot_verify+0x15c
  S: 0000000031cc3c00 R: 0000000030030a9c   .flash_load_resources+0x5fc
  S: 0000000031cc3d40 R: 0000000030018d5c   .cpu_process_jobs+0xdc
  S: 0000000031cc3e00 R: 0000000030014ec8   .__secondary_cpu_entry+0x44
  S: 0000000031cc3e80 R: 0000000030014f1c   .secondary_cpu_entry+0x34
  S: 0000000031cc3f00 R: 0000000030002790   secondary_wait+0x8c
  --- OPAL boot ---

We need corresponding changes in op-build as well to make it signed.


Thanks
Pridhiviraj