October 2026 - flashrom-gerrit

[S] Change in flashrom[main]: chipset_enable: Define register macros at file scope
by Anastasia Klimchuk (Code Review) Oct. 6, 2026

Oct. 6, 2026

Attention is currently required from: Abdelkader Boudih. Anastasia Klimchuk has posted comments on this change by Abdelkader Boudih. ( https://review.coreboot.org/c/flashrom/+/96020?usp=email ) Change subject: chipset_enable: Define register macros at file scope ...................................................................... Patch Set 2: Code-Review+2 (1 comment) Patchset: PS1: > So these macros are already usable by every function below them; defining them inside the body only makes them look local. I see, thanks for explaining! -- To view, visit https://review.coreboot.org/c/flashrom/+/96020?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: flashrom Gerrit-Branch: main Gerrit-Change-Id: Idaa51ff503bb98914750d944f259edb52b0888a8 Gerrit-Change-Number: 96020 Gerrit-PatchSet: 2 Gerrit-Owner: Abdelkader Boudih <coreboot(a)seuros.com> Gerrit-Reviewer: Anastasia Klimchuk <aklm(a)chromium.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Abdelkader Boudih <coreboot(a)seuros.com> Gerrit-Comment-Date: Tue, 06 Oct 2026 10:27:31 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes Comment-In-Reply-To: Abdelkader Boudih <coreboot(a)seuros.com> Comment-In-Reply-To: Anastasia Klimchuk <aklm(a)chromium.org>

1 0

[S] Change in flashrom[main]: chipset_enable: Define register macros at file scope
by Abdelkader Boudih (Code Review) Oct. 6, 2026

Oct. 6, 2026

Attention is currently required from: Anastasia Klimchuk. Abdelkader Boudih has posted comments on this change by Abdelkader Boudih. ( https://review.coreboot.org/c/flashrom/+/96020?usp=email ) Change subject: chipset_enable: Define register macros at file scope ...................................................................... Patch Set 2: (1 comment) File chipset_enable.c: https://review.coreboot.org/c/flashrom/+/96020/comment/3c7bc015_5748c251?us… : PS2, Line 1302: #define DECODE_CONTROL_REG2 0x5b /* F0 index 0x5b */ : #define ROM_AT_LOGIC_CONTROL_REG 0x52 /* F0 index 0x52 */ : #define CS5530_RESET_CONTROL_REG 0x44 /* F0 index 0x44 */ : #define CS5530_USB_SHADOW_REG 0x43 /* F0 index 0x43 */ : : #define LOWER_ROM_ADDRESS_RANGE BIT(0) : #define ROM_WRITE_ENABLE BIT(1) : #define UPPER_ROM_ADDRESS_RANGE BIT(2) : #define BIOS_ROM_POSITIVE_DECODE BIT(5) : #define CS5530_ISA_MASTER BIT(7) : #define CS5530_ENABLE_SA2320 BIT(2) : #define CS5530_ENABLE_SA20 BIT(6) > Maybe move these ones too? they are in the same situation Will do that when reach that part of code :) -- To view, visit https://review.coreboot.org/c/flashrom/+/96020?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: flashrom Gerrit-Branch: main Gerrit-Change-Id: Idaa51ff503bb98914750d944f259edb52b0888a8 Gerrit-Change-Number: 96020 Gerrit-PatchSet: 2 Gerrit-Owner: Abdelkader Boudih <coreboot(a)seuros.com> Gerrit-Reviewer: Anastasia Klimchuk <aklm(a)chromium.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Anastasia Klimchuk <aklm(a)chromium.org> Gerrit-Comment-Date: Tue, 06 Oct 2026 10:01:40 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Anastasia Klimchuk <aklm(a)chromium.org>

1 0

[S] Change in flashrom[main]: chipset_enable: Define register macros at file scope
by Anastasia Klimchuk (Code Review) Oct. 6, 2026

Oct. 6, 2026

Attention is currently required from: Abdelkader Boudih. Anastasia Klimchuk has posted comments on this change by Abdelkader Boudih. ( https://review.coreboot.org/c/flashrom/+/96020?usp=email ) Change subject: chipset_enable: Define register macros at file scope ...................................................................... Patch Set 2: (1 comment) File chipset_enable.c: https://review.coreboot.org/c/flashrom/+/96020/comment/cb4a1baa_1d03e819?us… : PS2, Line 1302: #define DECODE_CONTROL_REG2 0x5b /* F0 index 0x5b */ : #define ROM_AT_LOGIC_CONTROL_REG 0x52 /* F0 index 0x52 */ : #define CS5530_RESET_CONTROL_REG 0x44 /* F0 index 0x44 */ : #define CS5530_USB_SHADOW_REG 0x43 /* F0 index 0x43 */ : : #define LOWER_ROM_ADDRESS_RANGE BIT(0) : #define ROM_WRITE_ENABLE BIT(1) : #define UPPER_ROM_ADDRESS_RANGE BIT(2) : #define BIOS_ROM_POSITIVE_DECODE BIT(5) : #define CS5530_ISA_MASTER BIT(7) : #define CS5530_ENABLE_SA2320 BIT(2) : #define CS5530_ENABLE_SA20 BIT(6) Maybe move these ones too? they are in the same situation -- To view, visit https://review.coreboot.org/c/flashrom/+/96020?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: flashrom Gerrit-Branch: main Gerrit-Change-Id: Idaa51ff503bb98914750d944f259edb52b0888a8 Gerrit-Change-Number: 96020 Gerrit-PatchSet: 2 Gerrit-Owner: Abdelkader Boudih <coreboot(a)seuros.com> Gerrit-Reviewer: Anastasia Klimchuk <aklm(a)chromium.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Abdelkader Boudih <coreboot(a)seuros.com> Gerrit-Comment-Date: Tue, 06 Oct 2026 09:08:53 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No

1 0

[S] Change in flashrom[main]: flashchips: Add EN25QE32A
by Anastasia Klimchuk (Code Review) Oct. 6, 2026

Oct. 6, 2026

Attention is currently required from: Lewis O'Flynn, Stefan Reinauer. Anastasia Klimchuk has posted comments on this change by Lewis O'Flynn. ( https://review.coreboot.org/c/flashrom/+/95980?usp=email ) Change subject: flashchips: Add EN25QE32A ...................................................................... Patch Set 1: (1 comment) Patchset: PS1: Hello Lewis, thank you for the patch! We have just introduced a new macro for the common erase blocks layout (you can see by the link in the first comment). You will have 1 line to define erase blocks. You can also wait for 2 days until the other patch merged, and then sync you local repo, if it's easier for you. -- To view, visit https://review.coreboot.org/c/flashrom/+/95980?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: flashrom Gerrit-Branch: main Gerrit-Change-Id: I1f3d86d6190dda95c00ce197d06344a4c8578557 Gerrit-Change-Number: 95980 Gerrit-PatchSet: 1 Gerrit-Owner: Lewis O'Flynn <lewis.oflynn(a)morsemicro.com> Gerrit-Reviewer: Abdelkader Boudih <coreboot(a)seuros.com> Gerrit-Reviewer: Anastasia Klimchuk <aklm(a)chromium.org> Gerrit-Reviewer: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Gerrit-Attention: Lewis O'Flynn <lewis.oflynn(a)morsemicro.com> Gerrit-Comment-Date: Tue, 06 Oct 2026 08:59:43 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No

1 0

[XL] Change in flashrom[main]: flashchips: Add a macro for the common uniform SPI erase layout
by Anastasia Klimchuk (Code Review) Oct. 6, 2026

Oct. 6, 2026

Attention is currently required from: Abdelkader Boudih, Stefan Reinauer. Anastasia Klimchuk has posted comments on this change by Abdelkader Boudih. ( https://review.coreboot.org/c/flashrom/+/95984?usp=email ) Change subject: flashchips: Add a macro for the common uniform SPI erase layout ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://review.coreboot.org/c/flashrom/+/95984?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: flashrom Gerrit-Branch: main Gerrit-Change-Id: I803d9c0ab23902020aad23701816c97a1a318fc2 Gerrit-Change-Number: 95984 Gerrit-PatchSet: 2 Gerrit-Owner: Abdelkader Boudih <coreboot(a)seuros.com> Gerrit-Reviewer: Anastasia Klimchuk <aklm(a)chromium.org> Gerrit-Reviewer: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Abdelkader Boudih <coreboot(a)seuros.com> Gerrit-Attention: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Gerrit-Comment-Date: Tue, 06 Oct 2026 08:54:49 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[M] Change in flashrom[main]: cli_classic: Add --checksum option to print or verify flash SHA256
by Abdelkader Boudih (Code Review) Oct. 6, 2026

Oct. 6, 2026

Attention is currently required from: Abdelkader Boudih. Hello Anastasia Klimchuk, Peter Marheine, build bot (Jenkins), I'd like you to reexamine a change. Please visit https://review.coreboot.org/c/flashrom/+/91489?usp=email to look at the new patch set (#4). The following approvals got outdated and were removed: Verified+1 by build bot (Jenkins) Change subject: cli_classic: Add --checksum option to print or verify flash SHA256 ...................................................................... cli_classic: Add --checksum option to print or verify flash SHA256 Add --checksum[=<sha256>] to compute the SHA256 digest of the full flash contents using read_extended_sha256() from read_extended_crypto.c. Without an argument the digest is printed to stdout. With a 64-character hex argument the digest is compared and flashrom exits non-zero on mismatch, making it suitable for scripted verification and CI pipelines. The option is always registered so that builds without libcrypto print a clear error message instead of failing with getopt's generic "unrecognized option". The implementation is gated by CONFIG_WITH_CRYPTO (introduced in the preceding meson commit) and does not pull any crypto headers into cli_classic.c. Shell redirection (flashrom -r >(sha256sum)) can print a digest but cannot verify against an expected value in a single command, requires /dev/fd support absent on some embedded or recovery environments, and does not produce a non-zero exit code on mismatch. --checksum addresses all three limitations. Change-Id: Iaaa16ff6f3286cb93cbd1cd2943922a45de10149 Signed-off-by: Abdelkader Boudih <coreboot(a)seuros.com> --- M cli_classic.c M doc/classic_cli_manpage.rst 2 files changed, 63 insertions(+), 1 deletion(-) git pull ssh://review.coreboot.org:29418/flashrom refs/changes/89/91489/4 -- To view, visit https://review.coreboot.org/c/flashrom/+/91489?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: flashrom Gerrit-Branch: main Gerrit-Change-Id: Iaaa16ff6f3286cb93cbd1cd2943922a45de10149 Gerrit-Change-Number: 91489 Gerrit-PatchSet: 4 Gerrit-Owner: Abdelkader Boudih <coreboot(a)seuros.com> Gerrit-Reviewer: Anastasia Klimchuk <aklm(a)chromium.org> Gerrit-Reviewer: Peter Marheine <pmarheine(a)chromium.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Abdelkader Boudih <coreboot(a)seuros.com>

1 0

[M] Change in flashrom[main]: cli_classic: Add --checksum option to print or verify flash SHA256
by Abdelkader Boudih (Code Review) Oct. 6, 2026

Oct. 6, 2026

Attention is currently required from: Anastasia Klimchuk. Abdelkader Boudih has uploaded this change for review. ( https://review.coreboot.org/c/flashrom/+/96061?usp=email ) Change subject: cli_classic: Add --checksum option to print or verify flash SHA256 ...................................................................... cli_classic: Add --checksum option to print or verify flash SHA256 Add --checksum[=<sha256>] to compute the SHA256 digest of the full flash contents using read_extended_sha256() from read_extended_crypto.c. Without an argument the digest is printed to stdout. With a 64-character hex argument the digest is compared and flashrom exits non-zero on mismatch, making it suitable for scripted verification and CI pipelines. The option is always registered so that builds without libcrypto print a clear error message instead of failing with getopt's generic "unrecognized option". The implementation is gated by CONFIG_WITH_CRYPTO (introduced in the preceding meson commit) and does not pull any crypto headers into cli_classic.c. Shell redirection (flashrom -r >(sha256sum)) can print a digest but cannot verify against an expected value in a single command, requires /dev/fd support absent on some embedded or recovery environments, and does not produce a non-zero exit code on mismatch. --checksum addresses all three limitations. Change-Id: I4ed8f26ee374213548c9fbc8d2c06553fea1cccb Signed-off-by: Abdelkader Boudih <coreboot(a)seuros.com> --- M cli_classic.c M doc/classic_cli_manpage.rst 2 files changed, 63 insertions(+), 1 deletion(-) git pull ssh://review.coreboot.org:29418/flashrom refs/changes/61/96061/1 diff --git a/cli_classic.c b/cli_classic.c index be49e4e..39a0d62 100644 --- a/cli_classic.c +++ b/cli_classic.c @@ -48,6 +48,7 @@ OPTION_PROGRESS, OPTION_SACRIFICE_RATIO, OPTION_READ_REPEATED, + OPTION_CHECKSUM, #if CONFIG_RPMC_ENABLED == 1 OPTION_RPMC_READ_DATA, OPTION_RPMC_WRITE_ROOT_KEY, @@ -88,6 +89,8 @@ const char *chip_to_probe; int sacrifice_ratio; int read_repeated; + bool do_checksum; + const char *expected_checksum; #if CONFIG_RPMC_ENABLED == 1 bool rpmc_read_data; @@ -160,6 +163,11 @@ " voting to detect unstable connections.\n" " Reports X/N reads matched. Saves\n" " majority content to <file> if given.\n" + "CHECKSUM\n" + " --checksum[=<sha256>] compute SHA256 of flash contents.\n" + " Without argument: print the digest.\n" + " With argument: verify and exit non-zero\n" + " on mismatch.\n" #if CONFIG_RPMC_ENABLED == 1 "RPMC COMMANDS\n" " --get-rpmc-status read the extended status\n" @@ -670,6 +678,13 @@ return ret; } +#if CONFIG_WITH_CRYPTO == 1 +static int do_checksum(struct flashctx *const flash, const char *expected) +{ + return read_extended_sha256(flash, expected); +} +#endif /* CONFIG_WITH_CRYPTO */ + static int do_read(struct flashctx *const flash, const char *const filename) { int ret; @@ -1051,6 +1066,20 @@ } options->filename = get_optional_filename(argv); break; + case OPTION_CHECKSUM: +#if CONFIG_WITH_CRYPTO == 1 + cli_classic_validate_singleop(&operation_specified); + if (optarg && (strlen(optarg) != 64 || + optarg[strspn(optarg, "0123456789abcdefABCDEF")] != '\0')) + cli_classic_abort_usage("Error: --checksum expects a 64-character hex " + "SHA256 digest. Aborting.\n"); + options->do_checksum = true; + options->expected_checksum = optarg; +#else + cli_classic_abort_usage("Error: --checksum requires flashrom to be built " + "with -Dcrypto=enabled (libcrypto >= 3.0).\n"); +#endif /* CONFIG_WITH_CRYPTO */ + break; #if CONFIG_RPMC_ENABLED == 1 case OPTION_RPMC_READ_DATA: options->rpmc_read_data = true; @@ -1156,6 +1185,7 @@ {"progress", 0, NULL, OPTION_PROGRESS}, {"sacrifice-ratio", 1, NULL, OPTION_SACRIFICE_RATIO}, {"read-repeated", 2, NULL, OPTION_READ_REPEATED}, + {"checksum", 2, NULL, OPTION_CHECKSUM}, #if CONFIG_RPMC_ENABLED == 1 {"get-rpmc-status", 0, NULL, OPTION_RPMC_READ_DATA}, {"write-root-key", 0, NULL, OPTION_RPMC_WRITE_ROOT_KEY}, @@ -1391,7 +1421,7 @@ const bool any_op = options.read_it || options.write_it || options.verify_it || options.erase_it || options.flash_name || options.flash_size || options.extract_it || any_wp_op || any_rpmc_op || - options.read_repeated > 0; + options.read_repeated > 0 || options.do_checksum; if (!any_op) { msg_ginfo("No operations were specified.\n"); @@ -1617,6 +1647,10 @@ programmer_delay(context, 100000); if (options.read_repeated > 0) ret = do_read_repeated(context, options.read_repeated, options.filename); +#if CONFIG_WITH_CRYPTO == 1 + else if (options.do_checksum) + ret = do_checksum(context, options.expected_checksum); +#endif /* CONFIG_WITH_CRYPTO */ else if (options.read_it) ret = do_read(context, options.filename); else if (options.extract_it) diff --git a/doc/classic_cli_manpage.rst b/doc/classic_cli_manpage.rst index 99bbd00..39fcd6b 100644 --- a/doc/classic_cli_manpage.rst +++ b/doc/classic_cli_manpage.rst @@ -25,6 +25,7 @@ | [--get-rpmc-status] [--write-root-key] [--update-hmac-key] | [--increment-counter <current>] [--get-counter])] | [-V[V[V]]] [-o <logfile>] [--progress] [--sacrifice-ratio <ratio>] [--read-repeated[=<count>] [<file>]] +| [--checksum[=<sha256>]] DESCRIPTION @@ -426,6 +427,33 @@ **-R, --version** Show version information and exit. +Checksum +^^^^^^^^ + +.. note:: + Requires flashrom to be built with ``-Dcrypto=enabled`` (libcrypto >= 3.0.0). + +**--checksum[=<sha256>]** + Compute the SHA256 digest of the full flash contents. + + Without an argument the digest is printed to stdout:: + + flashrom -p prog --checksum + + With a 64-character hex argument the computed digest is + compared against it. The command exits with a non-zero status on + mismatch, making it suitable for use in scripts and CI pipelines:: + + flashrom -p prog --checksum=aabbcc... + + If a layout is used with **-i**, only the included regions are read and + the rest of the image is hashed as zeros. + + Unlike piping through ``sha256sum``, this option works on systems + without ``/dev/fd`` support and returns a meaningful exit code + directly when the digest does not match. + + RPMC commands ^^^^^^^^^^^^^ -- To view, visit https://review.coreboot.org/c/flashrom/+/96061?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: flashrom Gerrit-Branch: main Gerrit-Change-Id: I4ed8f26ee374213548c9fbc8d2c06553fea1cccb Gerrit-Change-Number: 96061 Gerrit-PatchSet: 1 Gerrit-Owner: Abdelkader Boudih <coreboot(a)seuros.com> Gerrit-Reviewer: Anastasia Klimchuk <aklm(a)chromium.org> Gerrit-Attention: Anastasia Klimchuk <aklm(a)chromium.org>

1 0

[M] Change in flashrom[main]: read_extended_crypto: Add SHA256 flash read helper
by Abdelkader Boudih (Code Review) Oct. 6, 2026

Oct. 6, 2026

Attention is currently required from: Anastasia Klimchuk, Peter Marheine. Abdelkader Boudih has uploaded this change for review. ( https://review.coreboot.org/c/flashrom/+/96060?usp=email ) Change subject: read_extended_crypto: Add SHA256 flash read helper ...................................................................... read_extended_crypto: Add SHA256 flash read helper Add read_extended_sha256() which reads the full flash content and computes its SHA256 digest using EVP_Q_digest() (OpenSSL >= 3.0). If expected_hex is NULL the digest is printed to the console. If expected_hex is provided the digest is compared against it and a non-zero value is returned on mismatch, making the function suitable for scripted verification. The implementation lives in a separate source file that is only compiled when CONFIG_WITH_CRYPTO=1 (i.e. when libcrypto is available and the crypto meson option is not disabled). Change-Id: Id503763e75031e292e39323208aad7809dc1ef1b Signed-off-by: Abdelkader Boudih <coreboot(a)seuros.com> --- M include/read_extended.h M meson.build A read_extended_crypto.c M tests/dummyflasher.c M tests/tests.c M tests/tests.h 6 files changed, 105 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/flashrom refs/changes/60/96060/1 diff --git a/include/read_extended.h b/include/read_extended.h index bc6ca37..c7919a1 100644 --- a/include/read_extended.h +++ b/include/read_extended.h @@ -24,4 +24,16 @@ int read_repeated(struct flashctx *flash, int count, unsigned char **result_buf, size_t *result_size); +#if CONFIG_WITH_CRYPTO == 1 +/** + * Read a flash chip, compute its SHA256 digest, and optionally verify it. + * + * @param flash Flash chip context (must be probed). + * @param expected_hex Expected digest as a 64-char lowercase hex string, + * or NULL to only print the digest. + * @return 0 on success or match, non-zero on read error or digest mismatch. + */ +int read_extended_sha256(struct flashctx *flash, const char *expected_hex); +#endif /* CONFIG_WITH_CRYPTO */ + #endif /* __READ_EXTENDED_H__ */ diff --git a/meson.build b/meson.build index ee9dfd2..14b6b5d 100644 --- a/meson.build +++ b/meson.build @@ -162,6 +162,7 @@ if libcrypto.found() add_project_arguments('-DCONFIG_WITH_CRYPTO=1', language : 'c') deps += libcrypto + srcs += 'read_extended_crypto.c' # RPMC requires crypto; include it when not explicitly disabled if not get_option('rpmc').disabled() add_project_arguments('-DCONFIG_RPMC_ENABLED=1', language : 'c') diff --git a/read_extended_crypto.c b/read_extended_crypto.c new file mode 100644 index 0000000..7c2959a --- /dev/null +++ b/read_extended_crypto.c @@ -0,0 +1,60 @@ +/* + * SPDX-License-Identifier: GPL-2.0-or-later + * SPDX-FileCopyrightText: 2026 Abdelkader Boudih <coreboot(a)seuros.com> + */ + +#include <openssl/evp.h> +#include <openssl/sha.h> +#include <stdio.h> +#include <stdlib.h> +#include <strings.h> + +#include "log.h" +#include "flash.h" +#include "libflashrom.h" +#include "read_extended.h" + +/* Read flash, compute SHA256, and optionally verify against an expected hex string. + * If expected_hex is NULL, the digest is printed. Otherwise it is compared and + * a non-zero value is returned on mismatch. */ +int read_extended_sha256(struct flashctx *const flash, const char *expected_hex) +{ + const size_t size = flashrom_flash_getsize(flash); + unsigned char *buf = calloc(size, 1); + int ret = 0; + + if (!buf) { + msg_gerr("Memory allocation failed!\n"); + return 1; + } + + ret = flashrom_image_read(flash, buf, size); + if (ret) + goto free_out; + + unsigned char digest[SHA256_DIGEST_LENGTH]; + size_t digest_len = sizeof(digest); + if (!EVP_Q_digest(NULL, "SHA256", NULL, buf, size, digest, &digest_len)) { + msg_gerr("SHA256 computation failed!\n"); + ret = 1; + goto free_out; + } + + char hex[SHA256_DIGEST_LENGTH * 2 + 1]; + for (int i = 0; i < SHA256_DIGEST_LENGTH; i++) + snprintf(hex + i * 2, 3, "%02x", digest[i]); + + if (!expected_hex) { + msg_ginfo("SHA256: %s\n", hex); + } else if (strcasecmp(hex, expected_hex) == 0) { + msg_ginfo("SHA256: %s OK\n", hex); + } else { + msg_gerr("SHA256 mismatch!\n expected: %s\n got: %s\n", + expected_hex, hex); + ret = 1; + } + +free_out: + free(buf); + return ret; +} diff --git a/tests/dummyflasher.c b/tests/dummyflasher.c index 206dbba..af1dce8 100644 --- a/tests/dummyflasher.c +++ b/tests/dummyflasher.c @@ -250,6 +250,35 @@ dummy_test_shutdown(flashctx, flashprog); } +#if CONFIG_WITH_CRYPTO == 1 +void dummy_probe_and_checksum(void **state) +{ + (void) state; /* unused */ + + struct flashrom_programmer *flashprog = NULL; + struct flashrom_flashctx *flashctx = NULL; + assert_int_equal(0, flashrom_create_context(&flashctx)); + + dummy_test_init_and_probe(flashctx, flashprog); + + /* SHA256 of the erased 16 MiB emulated chip (all 0xff) */ + const char *erased = "dffab0dd410657cb30c7b2fd7f2586a4792e8472e58882b3532581f8111a646d"; + const char *erased_upper = "DFFAB0DD410657CB30C7B2FD7F2586A4792E8472E58882B3532581F8111A646D"; + const char *wrong = "0000000000000000000000000000000000000000000000000000000000000000"; + + printf("Testing read_extended_sha256 ...\n"); + assert_int_equal(0, read_extended_sha256(flashctx, NULL)); + assert_int_equal(0, read_extended_sha256(flashctx, erased)); + assert_int_equal(0, read_extended_sha256(flashctx, erased_upper)); + assert_int_not_equal(0, read_extended_sha256(flashctx, wrong)); + printf("... read_extended_sha256 successful.\n"); + + dummy_test_shutdown(flashctx, flashprog); +} +#else + SKIP_TEST(dummy_probe_and_checksum) +#endif /* CONFIG_WITH_CRYPTO */ + #else SKIP_TEST(dummy_basic_lifecycle_test_success) SKIP_TEST(dummy_probe_lifecycle_test_success) @@ -268,4 +297,5 @@ SKIP_TEST(dummy_probe_and_write) SKIP_TEST(dummy_probe_and_erase) SKIP_TEST(dummy_probe_and_read_repeated) + SKIP_TEST(dummy_probe_and_checksum) #endif /* CONFIG_DUMMY */ diff --git a/tests/tests.c b/tests/tests.c index 3a18132..318fa50 100644 --- a/tests/tests.c +++ b/tests/tests.c @@ -546,6 +546,7 @@ cmocka_unit_test(dummy_probe_and_write), cmocka_unit_test(dummy_probe_and_erase), cmocka_unit_test(dummy_probe_and_read_repeated), + cmocka_unit_test(dummy_probe_and_checksum), cmocka_unit_test(nicrealtek_basic_lifecycle_test_success), cmocka_unit_test(raiden_debug_basic_lifecycle_test_success), cmocka_unit_test(raiden_debug_targetAP_basic_lifecycle_test_success), diff --git a/tests/tests.h b/tests/tests.h index 1f89825..0c8dfd1 100644 --- a/tests/tests.h +++ b/tests/tests.h @@ -91,6 +91,7 @@ void dummy_probe_and_write(void **state); void dummy_probe_and_erase(void **state); void dummy_probe_and_read_repeated(void **state); +void dummy_probe_and_checksum(void **state); void nicrealtek_basic_lifecycle_test_success(void **state); void raiden_debug_basic_lifecycle_test_success(void **state); void raiden_debug_targetAP_basic_lifecycle_test_success(void **state); -- To view, visit https://review.coreboot.org/c/flashrom/+/96060?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: flashrom Gerrit-Branch: main Gerrit-Change-Id: Id503763e75031e292e39323208aad7809dc1ef1b Gerrit-Change-Number: 96060 Gerrit-PatchSet: 1 Gerrit-Owner: Abdelkader Boudih <coreboot(a)seuros.com> Gerrit-Reviewer: Anastasia Klimchuk <aklm(a)chromium.org> Gerrit-Reviewer: Peter Marheine <pmarheine(a)chromium.org> Gerrit-Attention: Peter Marheine <pmarheine(a)chromium.org> Gerrit-Attention: Anastasia Klimchuk <aklm(a)chromium.org>

1 0

[S] Change in flashrom[main]: meson: Add CONFIG_WITH_CRYPTO umbrella option
by Abdelkader Boudih (Code Review) Oct. 6, 2026

Oct. 6, 2026

Abdelkader Boudih has uploaded this change for review. ( https://review.coreboot.org/c/flashrom/+/96059?usp=email ) Change subject: meson: Add CONFIG_WITH_CRYPTO umbrella option ...................................................................... meson: Add CONFIG_WITH_CRYPTO umbrella option Add a new 'crypto' feature option that gates all cryptographic operations requiring libcrypto (OpenSSL >= 3.0). Separate this from the 'rpmc' option so features like --checksum can use libcrypto independently of RPMC support. CONFIG_WITH_CRYPTO=1 is defined when libcrypto is found and the crypto option is not explicitly disabled. CONFIG_RPMC_ENABLED=1 is set only when both crypto and the rpmc option are enabled (existing behavior preserved). Requesting rpmc while crypto is disabled is a configuration error instead of silently building without RPMC. Change-Id: Ifcc4359baa916cab823dc0a9b92d0f14f04d3b40 Signed-off-by: Abdelkader Boudih <coreboot(a)seuros.com> --- M meson.build M meson_options.txt 2 files changed, 19 insertions(+), 5 deletions(-) git pull ssh://review.coreboot.org:29418/flashrom refs/changes/59/96059/1 diff --git a/meson.build b/meson.build index b86f86f..ee9dfd2 100644 --- a/meson.build +++ b/meson.build @@ -140,7 +140,16 @@ libusb1 = dependency('libusb-1.0', required : group_usb) libftdi1 = dependency('libftdi1', required : group_ftdi) libjaylink = dependency('libjaylink', required : group_jlink, version : '>=0.3.0') -libcrypto = dependency('libcrypto', required : get_option('rpmc'), version : '>=3.0.0') +if get_option('crypto').disabled() + if get_option('rpmc').enabled() + error('rpmc requires the crypto option') + endif + libcrypto = dependency('', required : false) +else + libcrypto = dependency('libcrypto', + required : get_option('crypto').enabled() or get_option('rpmc').enabled(), + version : '>=3.0.0') +endif # ECAM is supported in libpci after 3.13.0 if libpci.version().version_compare('>=3.13.0') @@ -149,11 +158,15 @@ add_project_arguments('-DCONFIG_USE_LIBPCI_ECAM=0', language: 'c') endif -# Support additional rpmc commands if libcrypto is installed -if (get_option('rpmc').auto() or get_option('rpmc').enabled()) and libcrypto.found() - add_project_arguments('-DCONFIG_RPMC_ENABLED=1', language : 'c') - srcs += 'rpmc.c' +# Enable cryptographic features (--checksum, RPMC) when libcrypto is available +if libcrypto.found() + add_project_arguments('-DCONFIG_WITH_CRYPTO=1', language : 'c') deps += libcrypto + # RPMC requires crypto; include it when not explicitly disabled + if not get_option('rpmc').disabled() + add_project_arguments('-DCONFIG_RPMC_ENABLED=1', language : 'c') + srcs += 'rpmc.c' + endif endif # platform subdir should be built before programmers entries are processed diff --git a/meson_options.txt b/meson_options.txt index af97755..95b250b 100644 --- a/meson_options.txt +++ b/meson_options.txt @@ -21,6 +21,7 @@ option('delay_minimum_sleep_us', type : 'integer', min : 0, value : 100, description : 'Minimum time in microseconds to suspend execution for (rather than polling) when a delay is required.' + ' Larger values may perform better on machines with low timer resolution, at the cost of increased power.') +option('crypto', type : 'feature', value : 'auto', description : 'Cryptographic operations support (requires libcrypto >= 3.0.0)') option('rpmc', type : 'feature', value : 'auto', description : 'Support for Replay Protected Monotonic Counter (RPMC) commands as specified by JESD260') option('log_message_length_limit', type : 'integer', min : 64, max : 1024, value : 256, description : 'Log message length limit for v2 logging API') -- To view, visit https://review.coreboot.org/c/flashrom/+/96059?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: flashrom Gerrit-Branch: main Gerrit-Change-Id: Ifcc4359baa916cab823dc0a9b92d0f14f04d3b40 Gerrit-Change-Number: 96059 Gerrit-PatchSet: 1 Gerrit-Owner: Abdelkader Boudih <coreboot(a)seuros.com>

1 0

[S] Change in flashrom[main]: flashchips: Add EN25QE32A
by Abdelkader Boudih (Code Review) Oct. 6, 2026

Oct. 6, 2026

Attention is currently required from: Anastasia Klimchuk, Lewis O'Flynn, Stefan Reinauer. Abdelkader Boudih has posted comments on this change by Lewis O'Flynn. ( https://review.coreboot.org/c/flashrom/+/95980?usp=email ) Change subject: flashchips: Add EN25QE32A ...................................................................... Patch Set 1: Code-Review+1 Verified+1 (1 comment) Patchset: PS1: Thanks! Can you rebase this on top of CB:95984. The format will change -- To view, visit https://review.coreboot.org/c/flashrom/+/95980?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: flashrom Gerrit-Branch: main Gerrit-Change-Id: I1f3d86d6190dda95c00ce197d06344a4c8578557 Gerrit-Change-Number: 95980 Gerrit-PatchSet: 1 Gerrit-Owner: Lewis O'Flynn <lewis.oflynn(a)morsemicro.com> Gerrit-Reviewer: Abdelkader Boudih <coreboot(a)seuros.com> Gerrit-Reviewer: Anastasia Klimchuk <aklm(a)chromium.org> Gerrit-Reviewer: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Anastasia Klimchuk <aklm(a)chromium.org> Gerrit-Attention: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Gerrit-Attention: Lewis O'Flynn <lewis.oflynn(a)morsemicro.com> Gerrit-Comment-Date: Tue, 06 Oct 2026 07:23:56 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes

1 0