Julius Werner has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/29547 )
Change subject: security/vboot: Add measured boot mode
......................................................................
Patch Set 47:
(7 comments)
https://review.coreboot.org/#/c/29547/47/src/security/vboot/vboot_crtm.h
File src/security/vboot/vboot_crtm.h:
https://review.coreboot.org/#/c/29547/47/src/security/vboot/vboot_crtm.h@23
PS47, Line 23: #if IS_ENABLED(CONFIG_CHROMEOS)
This isn't helping... PCRs 0 and 1 are extended by vboot itself, regardless of whether you're using CONFIG_CHROMEOS. You need to make this branch the default for everyone. (That seems way less confusing than having two possible configs anyway.)
https://review.coreboot.org/#/c/29547/47/src/security/vboot/vboot_crtm.h@69
PS47, Line 69: // e.g. CMOS, NVRAM...
nit: I'm not sure if we really said we'd allow C99 comments in coreboot now, but even if so probably best to not mix the two within the same file.
https://review.coreboot.org/#/c/29547/47/src/security/vboot/vboot_crtm.h@70
PS47, Line 70: #define TPM_WHITELISTED_PCR 23
nit: Is there a good reason these are all so far apart? Why not just use RO = 8, RW = 9, payload = 10, unknown = 11 and whitelisted = 12 or something like that?
https://review.coreboot.org/#/c/29547/47/src/security/vboot/vboot_crtm.c
File src/security/vboot/vboot_crtm.c:
https://review.coreboot.org/#/c/29547/47/src/security/vboot/vboot_crtm.c@104
PS47, Line 104: }
nit: You essentially have this part three times now, so it probably makes sense to factor it out into a measure_stage(cbfs_path, pcr) function.
https://review.coreboot.org/#/c/29547/47/src/security/vboot/vboot_crtm.c@116
PS47, Line 116: if (IS_ENABLED(CONFIG_VBOOT_STARTS_IN_ROMSTAGE))
Rather than doing this, I think it would be cleaner to put a
if (!vboot_logic_executed())
return 0;
at the top of this file (otherwise, you have the same problem with a separate verstage).
https://review.coreboot.org/#/c/29547/47/src/security/vboot/vboot_crtm.c@142
PS47, Line 142: return -1;
Should this print some error as well?
https://review.coreboot.org/#/c/29547/47/src/security/vboot/vboot_logic.c
File src/security/vboot/vboot_logic.c:
https://review.coreboot.org/#/c/29547/47/src/security/vboot/vboot_logic.c@3…
PS47, Line 319: |
I assume this is supposed to be an & ?
(Also, maybe this would thematically fit better in extend_pcrs()?)
--
To view, visit https://review.coreboot.org/c/coreboot/+/29547
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I339a2f1051e44f36aba9f99828f130592a09355e
Gerrit-Change-Number: 29547
Gerrit-PatchSet: 47
Gerrit-Owner: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com>
Gerrit-Reviewer: Aaron Durbin <adurbin(a)chromium.org>
Gerrit-Reviewer: David Hendricks <david.hendricks(a)gmail.com>
Gerrit-Reviewer: Huang Jin <huang.jin(a)intel.com>
Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org>
Gerrit-Reviewer: Krystian Hebel <krystian.hebel(a)3mdeb.com>
Gerrit-Reviewer: Martin Roth <martinroth(a)google.com>
Gerrit-Reviewer: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Gerrit-Reviewer: Patrick Georgi <pgeorgi(a)google.com>
Gerrit-Reviewer: Patrick Rudolph <patrick.rudolph(a)9elements.com>
Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org>
Gerrit-Reviewer: Paul Menzel <paulepanter(a)users.sourceforge.net>
Gerrit-Reviewer: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com>
Gerrit-Reviewer: Piotr Król <piotr.krol(a)3mdeb.com>
Gerrit-Reviewer: Stefan Reinauer <stefan.reinauer(a)coreboot.org>
Gerrit-Reviewer: Werner Zeh <werner.zeh(a)siemens.com>
Gerrit-Reviewer: York Yang <york.yang(a)intel.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Comment-Date: Mon, 11 Feb 2019 21:28:41 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Gerrit-MessageType: comment
Philipp Hug has abandoned this change. ( https://review.coreboot.org/c/coreboot/+/28606 )
Change subject: WIP: Port libpayload to riscv
......................................................................
Abandoned
Closed in favor of 31356
--
To view, visit https://review.coreboot.org/c/coreboot/+/28606
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: rampayload
Gerrit-Change-Id: I91df02069a0f8fd8771f73de0e866e9cea05cded
Gerrit-Change-Number: 28606
Gerrit-PatchSet: 7
Gerrit-Owner: Philipp Hug <philipp(a)hug.cx>
Gerrit-Reviewer: Paul Menzel <paulepanter(a)users.sourceforge.net>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-MessageType: abandon
Kyösti Mälkki has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/27276 )
Change subject: soc/amd/common: Remove redundant ACPI S3 test
......................................................................
Patch Set 4:
(1 comment)
https://review.coreboot.org/#/c/27276/4/src/soc/amd/stoneyridge/Kconfig
File src/soc/amd/stoneyridge/Kconfig:
https://review.coreboot.org/#/c/27276/4/src/soc/amd/stoneyridge/Kconfig@a53
PS4, Line 53:
> I'm OK with this change. No change in compile time (see the makefile).
I don't remember the details now.. Was it so that Merlin Falcon (from CarrizoPI) could still do 'fastboot from MRC cache'? The code this guards (s3_resume.c) is not only for ACPI S3 so I expect to see some more changes here, i.e. the HAVE_ACPI_RESUME guard is not quite right.
Also, I plan to reuse that s3_resume.c with improved stage_cache and mrc_cache code with agesa/family16 that definetly can do fastboot but is currently not so clean implementation.
--
To view, visit https://review.coreboot.org/c/coreboot/+/27276
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I7c7a9ecbfcb82790e477d906a00f9749103b4045
Gerrit-Change-Number: 27276
Gerrit-PatchSet: 4
Gerrit-Owner: Kyösti Mälkki <kyosti.malkki(a)gmail.com>
Gerrit-Reviewer: Kyösti Mälkki <kyosti.malkki(a)gmail.com>
Gerrit-Reviewer: Marshall Dawson <marshalldawson3rd(a)gmail.com>
Gerrit-Reviewer: Paul Menzel <paulepanter(a)users.sourceforge.net>
Gerrit-Reviewer: Richard Spiegel <richard.spiegel(a)silverbackltd.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Comment-Date: Mon, 11 Feb 2019 19:26:07 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Marshall Dawson <marshalldawson3rd(a)gmail.com>
Comment-In-Reply-To: Richard Spiegel <richard.spiegel(a)silverbackltd.com>
Gerrit-MessageType: comment
Julius Werner has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/31315 )
Change subject: arch/arm64: Make ARM64 specific options depend on select ARCH_ARM64
......................................................................
Patch Set 2:
I'm not really a fan of the extra boilerplate in all SoC Kconfig files. Can you explain why this is necessary? If it's just about removing some unused lines from .config, that doesn't really seem worth it. (I'd be okay with guarding all the really arch-specific options like ARM64_USE_ARCH_TIMER, but I'd prefer the stage architecture selectors like ARCH_ROMSTAGE_ARM64 to stay available without having to add more select lines to SoCs.)
--
To view, visit https://review.coreboot.org/c/coreboot/+/31315
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Iaa9cd902281e51f823717f6ea4c72e5736fefb31
Gerrit-Change-Number: 31315
Gerrit-PatchSet: 2
Gerrit-Owner: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Comment-Date: Mon, 11 Feb 2019 19:20:10 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: No
Gerrit-MessageType: comment
Marshall Dawson has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/27276 )
Change subject: soc/amd/common: Remove redundant ACPI S3 test
......................................................................
Patch Set 4: Code-Review+2
(2 comments)
https://review.coreboot.org/#/c/27276/4/src/soc/amd/stoneyridge/Kconfig
File src/soc/amd/stoneyridge/Kconfig:
https://review.coreboot.org/#/c/27276/4/src/soc/amd/stoneyridge/Kconfig@a53
PS4, Line 53:
> Why remove? True, if no S3 enabled than the linker will not add these files. […]
I'm OK with this change. No change in compile time (see the makefile).
https://review.coreboot.org/#/c/27276/4/src/soc/amd/stoneyridge/chip.c
File src/soc/amd/stoneyridge/chip.c:
https://review.coreboot.org/#/c/27276/4/src/soc/amd/stoneyridge/chip.c@158
PS4, Line 158: acpi_s3_resume_allowed()
> Not sure why this more complicated test. If it's on a resume path, then certainly S3 is allowed.
Richard, look at acpi_s3_resume_allowed(). This will compile to if (0 && romstage_handoff_is_()) which avoids the 2nd check with all its cbmem stuff when resume is unsupported.
--
To view, visit https://review.coreboot.org/c/coreboot/+/27276
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I7c7a9ecbfcb82790e477d906a00f9749103b4045
Gerrit-Change-Number: 27276
Gerrit-PatchSet: 4
Gerrit-Owner: Kyösti Mälkki <kyosti.malkki(a)gmail.com>
Gerrit-Reviewer: Kyösti Mälkki <kyosti.malkki(a)gmail.com>
Gerrit-Reviewer: Marshall Dawson <marshalldawson3rd(a)gmail.com>
Gerrit-Reviewer: Paul Menzel <paulepanter(a)users.sourceforge.net>
Gerrit-Reviewer: Richard Spiegel <richard.spiegel(a)silverbackltd.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Comment-Date: Mon, 11 Feb 2019 19:12:50 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: Yes
Comment-In-Reply-To: Richard Spiegel <richard.spiegel(a)silverbackltd.com>
Gerrit-MessageType: comment
Hello Patrick Rudolph, build bot (Jenkins), Nico Huber, Patrick Georgi, Martin Roth,
I'd like you to reexamine a change. Please visit
https://review.coreboot.org/c/coreboot/+/31352
to look at the new patch set (#2).
Change subject: soc/intel/apl: Implement "Power State after Failure"
......................................................................
soc/intel/apl: Implement "Power State after Failure"
Change-Id: Ibf218b90088a45349c54f4b881e895bb852e88bb
Signed-off-by: Nico Huber <nico.huber(a)secunet.com>
---
M src/soc/intel/apollolake/Makefile.inc
M src/soc/intel/apollolake/pmc.c
M src/soc/intel/common/block/fast_spi/Makefile.inc
3 files changed, 48 insertions(+), 1 deletion(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/52/31352/2
--
To view, visit https://review.coreboot.org/c/coreboot/+/31352
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ibf218b90088a45349c54f4b881e895bb852e88bb
Gerrit-Change-Number: 31352
Gerrit-PatchSet: 2
Gerrit-Owner: Thomas Heijligen <src(a)posteo.de>
Gerrit-Reviewer: Martin Roth <martinroth(a)google.com>
Gerrit-Reviewer: Nico Huber <nico.h(a)gmx.de>
Gerrit-Reviewer: Patrick Georgi <pgeorgi(a)google.com>
Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org>
Gerrit-Reviewer: Thomas Heijligen <src(a)posteo.de>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-MessageType: newpatchset