Attention is currently required from: Paul Menzel.
Felix Singer has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/58886 )
Change subject: Documentation: Add some notes about how to integrate FSP
......................................................................
Patch Set 3: Code-Review+2
--
To view, visit https://review.coreboot.org/c/coreboot/+/58886
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I4efd273e4141dc6dc4cf8bdebda9cffd0d7cc1a1
Gerrit-Change-Number: 58886
Gerrit-PatchSet: 3
Gerrit-Owner: Patrick Georgi <patrick(a)coreboot.org>
Gerrit-Reviewer: Felix Singer <felixsinger(a)posteo.net>
Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Reviewer: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Nico Huber <nico.h(a)gmx.de>
Gerrit-CC: Subrata Banik <subrata.banik(a)intel.com>
Gerrit-Attention: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Comment-Date: Fri, 19 Nov 2021 17:56:35 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
Gerrit-MessageType: comment
Attention is currently required from: Maulik V Vaghela, Nick Vaccaro, EricR Lai.
Subrata Banik has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/59272 )
Change subject: mb/google/brya: Allow variants to choose CAR setup configuration
......................................................................
Patch Set 3:
(1 comment)
Patchset:
PS3:
Appreciate any feedback on this. Looking for closing this bug 😊
--
To view, visit https://review.coreboot.org/c/coreboot/+/59272
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ibe94e6b82739ec65829859271622d904d75e978d
Gerrit-Change-Number: 59272
Gerrit-PatchSet: 3
Gerrit-Owner: Subrata Banik <subrata.banik(a)intel.com>
Gerrit-Reviewer: EricR Lai <ericr_lai(a)compal.corp-partner.google.com>
Gerrit-Reviewer: Maulik V Vaghela <maulik.v.vaghela(a)intel.com>
Gerrit-Reviewer: Nick Vaccaro <nvaccaro(a)google.com>
Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Attention: Maulik V Vaghela <maulik.v.vaghela(a)intel.com>
Gerrit-Attention: Nick Vaccaro <nvaccaro(a)google.com>
Gerrit-Attention: EricR Lai <ericr_lai(a)compal.corp-partner.google.com>
Gerrit-Comment-Date: Fri, 19 Nov 2021 17:55:07 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Gerrit-MessageType: comment
Attention is currently required from: Arthur Heymans, Tristan Corrick, Angel Pons, Alexander Couzens, Patrick Rudolph.
Raul Rangel has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/59314 )
Change subject: cpu/haswell/*.c: Use static.c exposed lapic 0
......................................................................
Patch Set 2:
(1 comment)
File src/mainboard/google/auron/devicetree.cb:
https://review.coreboot.org/c/coreboot/+/59314/comment/3c3df598_86084a19
PS2, Line 20: device lapic 0xacac off end
> you would then have two isolated chips in the devicetree, which doesn't make sense. It would no longer be a device tree!
Is that really a problem though? A `chip` is a logical construct for configuring multiple devices with the same settings. The `cpu_cluster` and the `domain` are already children of the root node. i.e., They are siblings. So from the device hierarchy perspective, there is no change.
--
To view, visit https://review.coreboot.org/c/coreboot/+/59314
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ic449b2df8036e8c02b5559cca6b2e7479a70a786
Gerrit-Change-Number: 59314
Gerrit-PatchSet: 2
Gerrit-Owner: Arthur Heymans <arthur.heymans(a)9elements.com>
Gerrit-Reviewer: Alexander Couzens <lynxis(a)fe80.eu>
Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org>
Gerrit-Reviewer: Raul Rangel <rrangel(a)chromium.org>
Gerrit-Reviewer: Tristan Corrick <tristan(a)corrick.kiwi>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Attention: Arthur Heymans <arthur.heymans(a)9elements.com>
Gerrit-Attention: Tristan Corrick <tristan(a)corrick.kiwi>
Gerrit-Attention: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-Attention: Alexander Couzens <lynxis(a)fe80.eu>
Gerrit-Attention: Patrick Rudolph <siro(a)das-labor.org>
Gerrit-Comment-Date: Fri, 19 Nov 2021 17:32:53 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Raul Rangel <rrangel(a)chromium.org>
Comment-In-Reply-To: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-MessageType: comment
Attention is currently required from: Felix Singer, Paul Menzel.
Patrick Georgi has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/58886 )
Change subject: Documentation: Add some notes about how to integrate FSP
......................................................................
Patch Set 3:
(1 comment)
File Documentation/soc/intel/fsp/index.md:
https://review.coreboot.org/c/coreboot/+/58886/comment/280909df_a7ef43b2
PS2, Line 8: that affects
: way FSP works
> I feel like that doesn't sound right. […]
Done
--
To view, visit https://review.coreboot.org/c/coreboot/+/58886
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I4efd273e4141dc6dc4cf8bdebda9cffd0d7cc1a1
Gerrit-Change-Number: 58886
Gerrit-PatchSet: 3
Gerrit-Owner: Patrick Georgi <patrick(a)coreboot.org>
Gerrit-Reviewer: Felix Singer <felixsinger(a)posteo.net>
Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Reviewer: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Nico Huber <nico.h(a)gmx.de>
Gerrit-CC: Subrata Banik <subrata.banik(a)intel.com>
Gerrit-Attention: Felix Singer <felixsinger(a)posteo.net>
Gerrit-Attention: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Comment-Date: Fri, 19 Nov 2021 17:30:18 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Felix Singer <felixsinger(a)posteo.net>
Gerrit-MessageType: comment
Tim Crawford has abandoned this change. ( https://review.coreboot.org/c/coreboot/+/57541 )
Change subject: soc/intel/common/cse: Add option to set IME mode
......................................................................
Abandoned
Using CB:52800
--
To view, visit https://review.coreboot.org/c/coreboot/+/57541
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I38d320fbb157a628c5decc90e6ced78efbf85e0d
Gerrit-Change-Number: 57541
Gerrit-PatchSet: 7
Gerrit-Owner: Tim Crawford <tcrawford(a)system76.com>
Gerrit-Reviewer: Furquan Shaikh <furquan.m.shaikh(a)gmail.com>
Gerrit-Reviewer: Sean Rhodes <admin(a)starlabs.systems>
Gerrit-Reviewer: Subrata Banik <subrata.banik(a)intel.com>
Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-CC: Jeremy Soller <jeremy(a)system76.com>
Gerrit-CC: Nico Huber <nico.h(a)gmx.de>
Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-MessageType: abandon
Attention is currently required from: Paul Menzel.
Hello Felix Singer, build bot (Jenkins), Paul Menzel, Arthur Heymans,
I'd like you to reexamine a change. Please visit
https://review.coreboot.org/c/coreboot/+/58886
to look at the new patch set (#3).
Change subject: Documentation: Add some notes about how to integrate FSP
......................................................................
Documentation: Add some notes about how to integrate FSP
While we don't _want_ FSP, we can't get around it sometimes. But when
using it, we can still try to establish best practices to make life
easier for everybody.
Change-Id: I4efd273e4141dc6dc4cf8bdebda9cffd0d7cc1a1
Signed-off-by: Patrick Georgi <pgeorgi(a)google.com>
---
M Documentation/soc/intel/fsp/index.md
1 file changed, 12 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/86/58886/3
--
To view, visit https://review.coreboot.org/c/coreboot/+/58886
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I4efd273e4141dc6dc4cf8bdebda9cffd0d7cc1a1
Gerrit-Change-Number: 58886
Gerrit-PatchSet: 3
Gerrit-Owner: Patrick Georgi <patrick(a)coreboot.org>
Gerrit-Reviewer: Felix Singer <felixsinger(a)posteo.net>
Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Reviewer: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Nico Huber <nico.h(a)gmx.de>
Gerrit-CC: Subrata Banik <subrata.banik(a)intel.com>
Gerrit-Attention: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-MessageType: newpatchset
Attention is currently required from: Furquan Shaikh, Selma Bensaid, Tim Wawrzynczak, Subrata Banik, Julius Werner, Angel Pons, Aaron Durbin.
Bora Guvendik has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/51445 )
Change subject: timestamp: Add new helper functions
......................................................................
Patch Set 8:
(1 comment)
Commit Message:
https://review.coreboot.org/c/coreboot/+/51445/comment/d611ba79_ad2b3cac
PS3, Line 7: Add helper fucntions
> > Hi Bora, […]
Thanks for feedback, I will explore Julius's idea
Here is the sample output with current implementation (first boot on a rvp board)
0:1st timestamp 0
944:CSE sent 'Boot Stall Done' to PMC 297,000
945:CSE started to handle ICC configuration 304,000 (7,000)
946:CSE sent 'Host BIOS Prep Done' to PMC 309,000 (5,000)
947:CSE received 'CPU Reset Done Ack sent' from PMC 1,076,000 (767,000)
11:start of bootblock 1,103,646 (27,646)
12:end of bootblock 1,164,113 (60,466)
...
//input in ms
CSME Timestamp[1]:1 //EC Boot Load Done (CSME ROM starts main execution)
CSME Timestamp[6]:297 //CSME RBE set "Boot Stall Done" indication to PMC
CSME Timestamp[7]:304 //CSME start poll for PMC PPS register
CSME Timestamp[10]:309 //CSME set "Host Boot Prep Done" indication to PMC
CSME Timestamp[19]:1076 //PMC sent "Core Reset Done Ack – Sent" message to CSME
--
To view, visit https://review.coreboot.org/c/coreboot/+/51445
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I6b7065ed26e231fc898ae44bcc15cba6fb42b308
Gerrit-Change-Number: 51445
Gerrit-PatchSet: 8
Gerrit-Owner: Subrata Banik <subrata.banik(a)intel.com>
Gerrit-Reviewer: Aaron Durbin <adurbin(a)chromium.org>
Gerrit-Reviewer: Bora Guvendik <bora.guvendik(a)intel.com>
Gerrit-Reviewer: Furquan Shaikh <furquan.m.shaikh(a)gmail.com>
Gerrit-Reviewer: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Reviewer: Selma Bensaid <selma.bensaid(a)intel.com>
Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-CC: Julius Werner <jwerner(a)chromium.org>
Gerrit-Attention: Furquan Shaikh <furquan.m.shaikh(a)gmail.com>
Gerrit-Attention: Selma Bensaid <selma.bensaid(a)intel.com>
Gerrit-Attention: Tim Wawrzynczak <twawrzynczak(a)chromium.org>
Gerrit-Attention: Subrata Banik <subrata.banik(a)intel.com>
Gerrit-Attention: Julius Werner <jwerner(a)chromium.org>
Gerrit-Attention: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-Attention: Aaron Durbin <adurbin(a)chromium.org>
Gerrit-Comment-Date: Fri, 19 Nov 2021 17:29:01 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Bora Guvendik <bora.guvendik(a)intel.com>
Comment-In-Reply-To: Furquan Shaikh <furquan.m.shaikh(a)gmail.com>
Comment-In-Reply-To: Subrata Banik <subrata.banik(a)intel.com>
Comment-In-Reply-To: Julius Werner <jwerner(a)chromium.org>
Gerrit-MessageType: comment
Julius Werner has submitted this change. ( https://review.coreboot.org/c/coreboot/+/59097 )
Change subject: security/vboot: Add NVRAM counter for TPM 2.0
......................................................................
security/vboot: Add NVRAM counter for TPM 2.0
Create an NVRAM counter in TPM 2.0 that survives owner clear and can be
read and written without authorization. This counter allows to seal data
with the TPM that can only be unsealed before the counter was
incremented. It will be used during Chrome OS rollback to securely carry
data across a TPM clear.
Signed-off-by: Miriam Polzer <mpolzer(a)google.com>
Change-Id: I511dba3b3461713ce20fb2bda9fced0fee6517e1
Reviewed-on: https://review.coreboot.org/c/coreboot/+/59097
Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org>
Reviewed-by: Julius Werner <jwerner(a)chromium.org>
---
M src/security/vboot/antirollback.h
M src/security/vboot/secdata_tpm.c
2 files changed, 29 insertions(+), 0 deletions(-)
Approvals:
build bot (Jenkins): Verified
Julius Werner: Looks good to me, approved
diff --git a/src/security/vboot/antirollback.h b/src/security/vboot/antirollback.h
index a208c04..2297762 100644
--- a/src/security/vboot/antirollback.h
+++ b/src/security/vboot/antirollback.h
@@ -28,6 +28,7 @@
/* 0x100d: Hash of MRC_CACHE training data for non-recovery boot */
#define MRC_RW_HASH_NV_INDEX 0x100d
#define HASH_NV_SIZE VB2_SHA256_DIGEST_SIZE
+#define ENT_ROLLBACK_COUNTER_INDEX 0x100e
/* Zero-Touch Enrollment related spaces */
#define ZTE_BOARD_ID_NV_INDEX 0x3fff00
#define ZTE_RMA_SN_BITS_INDEX 0x3fff01
diff --git a/src/security/vboot/secdata_tpm.c b/src/security/vboot/secdata_tpm.c
index 0bc4f839..47efe2d 100644
--- a/src/security/vboot/secdata_tpm.c
+++ b/src/security/vboot/secdata_tpm.c
@@ -116,6 +116,17 @@
.TPMA_NV_WRITE_STCLEAR = 1,
};
+const static TPMA_NV rw_counter_attributes = {
+ .TPMA_NV_AUTHWRITE = 1,
+ .TPMA_NV_AUTHREAD = 1,
+ .TPMA_NV_PPREAD = 1,
+ .TPMA_NV_PPWRITE = 1,
+ .TPMA_NV_PLATFORMCREATE = 1,
+ .TPMA_NV_COUNTER = 1,
+ .TPMA_NV_NO_DA = 1,
+ .TPMA_NV_WRITE_STCLEAR = 1,
+};
+
static const TPMA_NV fwmp_attr = {
.TPMA_NV_PLATFORMCREATE = 1,
.TPMA_NV_OWNERWRITE = 1,
@@ -330,6 +341,15 @@
return rv;
}
+static uint32_t enterprise_rollback_create_counter(void)
+{
+ /*
+ * No need to increment the counter to initialize, this can be done later.
+ */
+ return tlcl_define_space(ENT_ROLLBACK_COUNTER_INDEX, /*size=*/8,
+ rw_counter_attributes, NULL, 0);
+}
+
static uint32_t _factory_initialize_tpm(struct vb2_context *ctx)
{
RETURN_ON_FAILURE(tlcl_force_clear());
@@ -363,6 +383,14 @@
CONFIG(MAINBOARD_HAS_I2C_TPM_CR50))))
RETURN_ON_FAILURE(setup_zte_spaces());
+ /*
+ * On TPM 2.0, create a counter that survives TPM clear. This allows to
+ * securely lock data during enterprise rollback by binding to this
+ * counter's value.
+ */
+ if (CONFIG(CHROMEOS))
+ RETURN_ON_FAILURE(enterprise_rollback_create_counter());
+
RETURN_ON_FAILURE(setup_firmware_space(ctx));
return TPM_SUCCESS;
--
To view, visit https://review.coreboot.org/c/coreboot/+/59097
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I511dba3b3461713ce20fb2bda9fced0fee6517e1
Gerrit-Change-Number: 59097
Gerrit-PatchSet: 8
Gerrit-Owner: Miriam Polzer <mpolzer(a)google.com>
Gerrit-Reviewer: Andrey Pronin <apronin(a)chromium.org>
Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org>
Gerrit-Reviewer: Yu-Ping Wu <yupingso(a)google.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-MessageType: merged
Attention is currently required from: Miriam Polzer, Andrey Pronin, Yu-Ping Wu.
Julius Werner has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/59097 )
Change subject: security/vboot: Add NVRAM counter for TPM 2.0
......................................................................
Patch Set 7: Code-Review+2
(1 comment)
File src/security/vboot/secdata_tpm.c:
https://review.coreboot.org/c/coreboot/+/59097/comment/df341179_a5b10e87
PS3, Line 150: .TPMA_NV_NO_DA = 1,
> Ah, now I understand. […]
It's just a precaution, yeah, I don't think we really know of a concrete scenario this is supposed to prevent. But in my experience, once you get a TPM into DA defense mode it can be really annoying to get out (and break everything), so preventing it from happening in the first place is nice.
--
To view, visit https://review.coreboot.org/c/coreboot/+/59097
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I511dba3b3461713ce20fb2bda9fced0fee6517e1
Gerrit-Change-Number: 59097
Gerrit-PatchSet: 7
Gerrit-Owner: Miriam Polzer <mpolzer(a)google.com>
Gerrit-Reviewer: Andrey Pronin <apronin(a)chromium.org>
Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org>
Gerrit-Reviewer: Yu-Ping Wu <yupingso(a)google.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Attention: Miriam Polzer <mpolzer(a)google.com>
Gerrit-Attention: Andrey Pronin <apronin(a)chromium.org>
Gerrit-Attention: Yu-Ping Wu <yupingso(a)google.com>
Gerrit-Comment-Date: Fri, 19 Nov 2021 17:19:33 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: Yes
Comment-In-Reply-To: Miriam Polzer <mpolzer(a)google.com>
Comment-In-Reply-To: Andrey Pronin <apronin(a)chromium.org>
Comment-In-Reply-To: Julius Werner <jwerner(a)chromium.org>
Gerrit-MessageType: comment