Attention is currently required from: Rob Barnes, Karthik Ramasubramanian.
Raul Rangel has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/60081 )
Change subject: mb/google/guybrush: Set TPM to to be kernel power managed.
......................................................................
Patch Set 4: Code-Review+2
--
To view, visit https://review.coreboot.org/c/coreboot/+/60081
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I206022cc2a29690186206966c5d45bd55c303248
Gerrit-Change-Number: 60081
Gerrit-PatchSet: 4
Gerrit-Owner: Rob Barnes <robbarnes(a)google.com>
Gerrit-Reviewer: Karthik Ramasubramanian <kramasub(a)google.com>
Gerrit-Reviewer: Raul Rangel <rrangel(a)chromium.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Attention: Rob Barnes <robbarnes(a)google.com>
Gerrit-Attention: Karthik Ramasubramanian <kramasub(a)google.com>
Gerrit-Comment-Date: Mon, 13 Dec 2021 22:06:04 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
Gerrit-MessageType: comment
Attention is currently required from: Sean Rhodes, Andy Pont.
Angel Pons has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/59705 )
Change subject: mainboard/starlabs/labtop: Hook up Thunderbolt to CMOS
......................................................................
Patch Set 16: Code-Review+2
--
To view, visit https://review.coreboot.org/c/coreboot/+/59705
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ibadc7464831242ae51982610b410ccf0a6811edd
Gerrit-Change-Number: 59705
Gerrit-PatchSet: 16
Gerrit-Owner: Sean Rhodes <admin(a)starlabs.systems>
Gerrit-Reviewer: Andy Pont <andy.pont(a)sdcsystems.com>
Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Felix Singer <felixsinger(a)posteo.net>
Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Attention: Sean Rhodes <admin(a)starlabs.systems>
Gerrit-Attention: Andy Pont <andy.pont(a)sdcsystems.com>
Gerrit-Comment-Date: Mon, 13 Dec 2021 22:03:27 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
Gerrit-MessageType: comment
Attention is currently required from: Andy Pont, Angel Pons.
Sean Rhodes has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/59705 )
Change subject: mainboard/starlabs/labtop: Hook up Thunderbolt to CMOS
......................................................................
Patch Set 16:
(1 comment)
This change is ready for review.
Patchset:
PS16:
That did the trick, thank you 😊
--
To view, visit https://review.coreboot.org/c/coreboot/+/59705
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ibadc7464831242ae51982610b410ccf0a6811edd
Gerrit-Change-Number: 59705
Gerrit-PatchSet: 16
Gerrit-Owner: Sean Rhodes <admin(a)starlabs.systems>
Gerrit-Reviewer: Andy Pont <andy.pont(a)sdcsystems.com>
Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Felix Singer <felixsinger(a)posteo.net>
Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Attention: Andy Pont <andy.pont(a)sdcsystems.com>
Gerrit-Attention: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-Comment-Date: Mon, 13 Dec 2021 21:58:47 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Gerrit-MessageType: comment
Attention is currently required from: Tim Wawrzynczak, Nick Vaccaro, Karthik Ramasubramanian.
Paul Menzel has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/60016 )
Change subject: drivers/generic/bayhub_lv2: Work around known errata
......................................................................
Patch Set 3: Code-Review+1
--
To view, visit https://review.coreboot.org/c/coreboot/+/60016
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I1813f798faa534fb212cb1a074bc7bcadd17a517
Gerrit-Change-Number: 60016
Gerrit-PatchSet: 3
Gerrit-Owner: Tim Wawrzynczak <twawrzynczak(a)chromium.org>
Gerrit-Reviewer: Karthik Ramasubramanian <kramasub(a)google.com>
Gerrit-Reviewer: Nick Vaccaro <nvaccaro(a)google.com>
Gerrit-Reviewer: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Kevin Chang <kevin.chang(a)lcfc.corp-partner.google.com>
Gerrit-Attention: Tim Wawrzynczak <twawrzynczak(a)chromium.org>
Gerrit-Attention: Nick Vaccaro <nvaccaro(a)google.com>
Gerrit-Attention: Karthik Ramasubramanian <kramasub(a)google.com>
Gerrit-Comment-Date: Mon, 13 Dec 2021 21:44:16 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
Gerrit-MessageType: comment
Attention is currently required from: Felix Singer.
Paul Menzel has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/60059 )
Change subject: mb/google/glados: Restore alphabetical order on Kconfig selects
......................................................................
Patch Set 2: Code-Review+1
--
To view, visit https://review.coreboot.org/c/coreboot/+/60059
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I736234b9a960c58193fcf7bc9184c9581c6c953b
Gerrit-Change-Number: 60059
Gerrit-PatchSet: 2
Gerrit-Owner: Felix Singer <felixsinger(a)posteo.net>
Gerrit-Reviewer: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Attention: Felix Singer <felixsinger(a)posteo.net>
Gerrit-Comment-Date: Mon, 13 Dec 2021 21:42:04 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
Gerrit-MessageType: comment
Attention is currently required from: Jakub Czapiga.
Julius Werner has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/59494 )
Change subject: libpayload/libc/fmap: Implement new FlashMap API
......................................................................
Patch Set 6:
(10 comments)
Patchset:
PS6:
Sorry, it's basically good but then I noticed a bunch of other stuff again...
File payloads/libpayload/libc/fmap.c:
https://review.coreboot.org/c/coreboot/+/59494/comment/de82ef94_014c185a
PS6, Line 34: #include <fmap_serialized.h>
While you're here would you mind also getting rid of this version of the file and have libpayload use the one in commonlib/bsd instead?
https://review.coreboot.org/c/coreboot/+/59494/comment/6fd5d2e4_515954d1
PS6, Line 41: int
This should then also be cb_err_t
https://review.coreboot.org/c/coreboot/+/59494/comment/39efc3fc_d54608a3
PS6, Line 50: 0
CB_SUCCESS
https://review.coreboot.org/c/coreboot/+/59494/comment/38b56ea1_73f0d13e
PS6, Line 53: -1
Probably not worth making a new type for this, so maybe just reuse CB_CBFS_NOT_FOUND here?
https://review.coreboot.org/c/coreboot/+/59494/comment/83a4005a_d8b8d444
PS6, Line 73: int
I'm actually surprised the compiler doesn't complain, but this should match the declaration (cb_err_t).
File payloads/libpayload/tests/libc/fmap_locate_area-test.c:
https://review.coreboot.org/c/coreboot/+/59494/comment/250f5c80_a23a60d9
PS6, Line 14: extern struct fmap *_fmap_cache;
This no longer belongs here
https://review.coreboot.org/c/coreboot/+/59494/comment/7e4fa92e_3a8eab72
PS6, Line 98: _fmap_cache = NULL;
Why not use reset_fmap_cache() for these?
https://review.coreboot.org/c/coreboot/+/59494/comment/d0c011ac_d104e5ba
PS6, Line 100: /* Different number of areas in fmap_cache and fmap_offset */
Okay so now the comment is correct but I'm still not sure why we want to test this? I would say the fact that the FMAP cache pointer is again cached locally in the compilation unit is a total implementation detail. If someone changed the implementation to not do that, that doesn't mean it's suddenly broken. So I don't know why we'd want the test to fail in that case.
https://review.coreboot.org/c/coreboot/+/59494/comment/e273ec3e_af83c78c
PS6, Line 101: lib_sysinfo.fmap_offset = (uint64_t)fmap_buffer;
This is super weird anyway. fmap_offset is an offset on flash, here you're treating it like a pointer to memory?
You don't have a real flash in this test, nor does the whole FMAP implementation ever try to access the flash (or read fmap_offset). fmap_offset is just completely irrelevant to this test.
--
To view, visit https://review.coreboot.org/c/coreboot/+/59494
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Idbf9016ce73aa58e17f3ee19920ab83dc6c25abb
Gerrit-Change-Number: 59494
Gerrit-PatchSet: 6
Gerrit-Owner: Jakub Czapiga <jacz(a)semihalf.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Julius Werner <jwerner(a)chromium.org>
Gerrit-CC: Patrick Georgi <patrick(a)coreboot.org>
Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Attention: Jakub Czapiga <jacz(a)semihalf.com>
Gerrit-Comment-Date: Mon, 13 Dec 2021 21:40:57 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Gerrit-MessageType: comment
Attention is currently required from: Felix Singer, Joey Peng, YH Lin.
Tim Wawrzynczak has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/60077 )
Change subject: mb/google/brya/var/taniks: Configure DRIVER_TPM_I2C_BUS for taniks
......................................................................
Patch Set 2: Code-Review+2
(1 comment)
Commit Message:
https://review.coreboot.org/c/coreboot/+/60077/comment/02278ab5_e15dc26f
PS2, Line 9: address
nit: remove this word, the I2C address is specified in devicetree, this is just which I2C bus to use for the TPM
--
To view, visit https://review.coreboot.org/c/coreboot/+/60077
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I9b1719c3140c13f67e7cb0e6a69257774884bd4d
Gerrit-Change-Number: 60077
Gerrit-PatchSet: 2
Gerrit-Owner: Joey Peng <joey.peng(a)lcfc.corp-partner.google.com>
Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org>
Gerrit-Reviewer: YH Lin <yueherngl(a)chromium.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Felix Singer <felixsinger(a)posteo.net>
Gerrit-CC: Jerry2 Huang <jerry2.huang(a)lcfc.corp-partner.google.com>
Gerrit-CC: Kevin Chang <kevin.chang(a)lcfc.corp-partner.google.com>
Gerrit-CC: Melo Chuang <melo.chuang(a)lcfc.corp-partner.google.com>
Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-CC: Sunshine Chao <sunshine.chao(a)lcfc.corp-partner.google.com>
Gerrit-Attention: Felix Singer <felixsinger(a)posteo.net>
Gerrit-Attention: Joey Peng <joey.peng(a)lcfc.corp-partner.google.com>
Gerrit-Attention: YH Lin <yueherngl(a)chromium.org>
Gerrit-Comment-Date: Mon, 13 Dec 2021 21:34:26 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: Yes
Gerrit-MessageType: comment
Attention is currently required from: Erik van den Bogaert, Felix Singer, Michał Żygowski, Frans Hendriks, Paul Menzel, Arthur Heymans, Wim Vervoorn.
Julius Werner has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/52025 )
Change subject: vc/eltan/security/verified_boot/vboot_check.c: Add cbfs_map_compressed()
......................................................................
Patch Set 4:
(1 comment)
Patchset:
PS3:
> Changing behavoir of functions might result in building binaries, but not garanty run-time functionality.
Exactly, that's the problem. The point of vendorcode is that you can put isolated pieces of code in there that don't really interact much with the rest of coreboot, so that vendors can implement their own isolated features that don't need to pass such a strict review process and community consensus as core coreboot patches, because they're out of the way and don't bother anyone else. But your feature here is anything but isolated: it makes deep assumptions about implementation details of CBFS (and vboot) and it's almost impossible for someone else to make changes to CBFS code without accidentally breaking your stuff. This is not maintainable. And we can't have a system where every vendor submits their own vendorcode that has all these deep dependencies on some core coreboot framework, then nobody could do any coreboot development at all anymore because you always risk breaking some vendor's special stuff. That's not what vendorcode was meant for.
> You point to CONFIG_CBFS_VERIFICATION, but the help mentioned work in progress. Do not use (yet).
Right, I've just updated the description of CONFIG_CBFS_VERIFICATION a few days ago, it should be ready for use now. See CB:59982.
> Does VBOOT contain function to hash unconpressed CBFS part?
So... CBFS verification will hash every file. For compressed files it will hash the compressed data and then check that hash before the file gets decompressed. With CBFS verification every file is directly tied to the bootblock, so you can't update individual files without updating the whole CBFS.
vboot splits CBFS into two areas (RO and RW). The whole RW area is hashed and signed (so not individual files one by one, but just the whole thing in one go). The public keys used to check that area are stored in the RO part. vboot is designed to be used with SPI flash write protection where the whole RO part is permanently write protected, and the RW part can be updated in the field. (Eventually the goal is to tie CBFS verification and vboot together, so that files in the RW area are also hashed individually and can be verified one at a time. That part isn't done yet. That is just an optimization, though... security-wise, the current version where the whole section is verified at once is just as secure.)
If you can tell me what kind of verification exactly you need (e.g. where is your root of trust, how do you protect it, how do you do updates, etc.) I can help you figure out which combination of these can work for your use case.
--
To view, visit https://review.coreboot.org/c/coreboot/+/52025
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Idc799f49ee198100deab1ecf66336831d9aed415
Gerrit-Change-Number: 52025
Gerrit-PatchSet: 4
Gerrit-Owner: Frans Hendriks <fhendriks(a)eltan.com>
Gerrit-Reviewer: Felix Singer <felixsinger(a)posteo.net>
Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Reviewer: Erik van den Bogaert <ebogaert(a)eltan.com>
Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org>
Gerrit-Reviewer: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Gerrit-Reviewer: Wim Vervoorn <wvervoorn(a)eltan.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Attention: Erik van den Bogaert <ebogaert(a)eltan.com>
Gerrit-Attention: Felix Singer <felixsinger(a)posteo.net>
Gerrit-Attention: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Gerrit-Attention: Frans Hendriks <fhendriks(a)eltan.com>
Gerrit-Attention: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Attention: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Attention: Wim Vervoorn <wvervoorn(a)eltan.com>
Gerrit-Comment-Date: Mon, 13 Dec 2021 21:18:32 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Frans Hendriks <fhendriks(a)eltan.com>
Comment-In-Reply-To: Julius Werner <jwerner(a)chromium.org>
Gerrit-MessageType: comment
Tim Wawrzynczak has submitted this change. ( https://review.coreboot.org/c/coreboot/+/60020 )
Change subject: soc/intel/common/cse: Update help text for CSE_OEMP_FILE
......................................................................
soc/intel/common/cse: Update help text for CSE_OEMP_FILE
The OEM may create and sign an Audio component to extend the Audio
capability provided by Intel. The manifest is then signed, and the
signature and public key are entered into the header of the manifest
to create the final signed component binary. This creates a secure
verification mechanism where firmware verifies that the OEM Key
Manifest was signed with a key owned by a trusted owner. Once OEM KM
is authenticated, each public key hash stored within the OEM KM is
able to authenticate the corresponding FW binary.
Link to the Document:
https://www.intel.com/content/www/us/en/secure/design/confidential/software…
ADL_Signing_and_Manifesting_User_Guide.pdf
BUG=b:207820413
TEST:none
Signed-off-by: ravindr1 <ravindra(a)intel.com>
Change-Id: Id52b51ab1c910d70b7897eb31add8287b5b0166f
Reviewed-on: https://review.coreboot.org/c/coreboot/+/60020
Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org>
Reviewed-by: Paul Menzel <paulepanter(a)mailbox.org>
Reviewed-by: Tim Wawrzynczak <twawrzynczak(a)chromium.org>
---
M src/soc/intel/common/block/cse/Kconfig
1 file changed, 5 insertions(+), 1 deletion(-)
Approvals:
build bot (Jenkins): Verified
Paul Menzel: Looks good to me, but someone else must approve
Tim Wawrzynczak: Looks good to me, approved
diff --git a/src/soc/intel/common/block/cse/Kconfig b/src/soc/intel/common/block/cse/Kconfig
index 055927b..ec901ca 100644
--- a/src/soc/intel/common/block/cse/Kconfig
+++ b/src/soc/intel/common/block/cse/Kconfig
@@ -181,7 +181,11 @@
This config indicates the BPDT version used by CSE for a given SoC.
config CSE_OEMP_FILE
- string "Name of OEM KM file"
+ string "Name of OEM Key Manifest file"
default "oem_km.bin"
+ help
+ OEM Key Manifest lists the public key hashes used for authenticating the
+ OEM created binaries to be loaded. This binary is generated by signing with
+ the key owned by trusted owner.
endif
--
To view, visit https://review.coreboot.org/c/coreboot/+/60020
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Id52b51ab1c910d70b7897eb31add8287b5b0166f
Gerrit-Change-Number: 60020
Gerrit-PatchSet: 4
Gerrit-Owner: Ravindra <ravindra(a)intel.com>
Gerrit-Reviewer: Nick Vaccaro <nvaccaro(a)chromium.org>
Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org>
Gerrit-Reviewer: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Reviewer: Sridhar Siricilla <sridhar.siricilla(a)intel.com>
Gerrit-Reviewer: Subrata Banik <subrata.banik(a)intel.com>
Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Balaji Manigandan <balaji.bmg(a)gmail.com>
Gerrit-CC: Krishna P Bhat D <krishna.p.bhat.d(a)intel.com>
Gerrit-CC: Ravindra N <ravindra(a)intel.corp-partner.google.com>
Gerrit-MessageType: merged