coreboot-gerrit May 2021

coreboot-gerrit@coreboot.org

1 participants
6048 discussions

Change in coreboot[master]: soc/intel/alderlake: Update meminit code due to upd changes FSP 2147 ...
by Balaji Manigandan (Code Review) 14 May '21

14 May '21

Attention is currently required from: Bora Guvendik, Furquan Shaikh, Selma Bensaid, Maulik V Vaghela, Ronak Kanabar, Tim Wawrzynczak, Patrick Rudolph. Balaji Manigandan has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/54036 ) Change subject: soc/intel/alderlake: Update meminit code due to upd changes FSP 2147 onwards ...................................................................... Patch Set 5: (1 comment) Commit Message: https://review.coreboot.org/c/coreboot/+/54036/comment/7232deff_10133719 PS4, Line 19: > Please update to: […] Done -- To view, visit https://review.coreboot.org/c/coreboot/+/54036 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I5af11ae99db3bbe3373a9bd4ce36453b58d62fec Gerrit-Change-Number: 54036 Gerrit-PatchSet: 5 Gerrit-Owner: Bora Guvendik <bora.guvendik(a)intel.com> Gerrit-Reviewer: Maulik V Vaghela <maulik.v.vaghela(a)intel.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Reviewer: Ronak Kanabar <ronak.kanabar(a)intel.com> Gerrit-Reviewer: Selma Bensaid <selma.bensaid(a)intel.com> Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Balaji Manigandan <balaji.manigandan(a)intel.com> Gerrit-CC: Furquan Shaikh <furquan(a)google.com> Gerrit-Attention: Bora Guvendik <bora.guvendik(a)intel.com> Gerrit-Attention: Furquan Shaikh <furquan(a)google.com> Gerrit-Attention: Selma Bensaid <selma.bensaid(a)intel.com> Gerrit-Attention: Maulik V Vaghela <maulik.v.vaghela(a)intel.com> Gerrit-Attention: Ronak Kanabar <ronak.kanabar(a)intel.com> Gerrit-Attention: Tim Wawrzynczak <twawrzynczak(a)google.com> Gerrit-Attention: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Comment-Date: Sat, 15 May 2021 04:02:32 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-MessageType: comment

1 0

Change in coreboot[master]: vendorcode/intel/fsp: Add Alder Lake FSP headers for FSP v2162_00
by Balaji Manigandan (Code Review) 14 May '21

14 May '21

Attention is currently required from: Bora Guvendik, V Sowmya, Furquan Shaikh, Maulik V Vaghela, Rizwan Qureshi, Subrata Banik, Meera Ravindranath, Bernardo Perez Priego, Tim Wawrzynczak, Ronak Kanabar, Srinidhi N Kaushik, Patrick Rudolph. Balaji Manigandan has uploaded a new patch set (#5) to the change originally created by Ronak Kanabar. ( https://review.coreboot.org/c/coreboot/+/54083 ) Change subject: vendorcode/intel/fsp: Add Alder Lake FSP headers for FSP v2162_00 ...................................................................... vendorcode/intel/fsp: Add Alder Lake FSP headers for FSP v2162_00 The headers added are generated as per FSP v2162_00. Previous FSP version was v2117_00. Changes Include: - Adjust UPD Offset in FspmUpd.h and FspsUpd.h - Remove DisableDimmMc*Ch* Upds in FspmUpd.h - Add DisableMc*Ch* Upds in FspmUpd.h - Few UPDs description update in FspmUpd.h and FspsUpd.h Change DisableDimmMc*Ch* to DisableMc*Ch* in meminit.c to avoid compilation failure other change related to UPDs name change will be part of next patch in relation chain. BUG=b:187189546 BRANCH=None TEST=Build and boot ADLRVP using all the patch in relation chain. Cq-Depend: chrome-internal:3831865, chrome-internal:3831864, chrome-internal:3831913 Cq-Depend: chromium:TODO Change-Id: Ic8d7980146f1bfc96472ef504cf9f16eee63a13e Cq-Depend: TBD Signed-off-by: Ronak Kanabar <ronak.kanabar(a)intel.com> --- M src/soc/intel/alderlake/meminit.c M src/vendorcode/intel/fsp/fsp2_0/alderlake/FspmUpd.h M src/vendorcode/intel/fsp/fsp2_0/alderlake/FspsUpd.h 3 files changed, 1,092 insertions(+), 1,090 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/83/54083/5 -- To view, visit https://review.coreboot.org/c/coreboot/+/54083 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Ic8d7980146f1bfc96472ef504cf9f16eee63a13e Gerrit-Change-Number: 54083 Gerrit-PatchSet: 5 Gerrit-Owner: Ronak Kanabar <ronak.kanabar(a)intel.com> Gerrit-Reviewer: Bernardo Perez Priego <bernardo.perez.priego(a)intel.com> Gerrit-Reviewer: Bora Guvendik <bora.guvendik(a)intel.com> Gerrit-Reviewer: Furquan Shaikh <furquan(a)google.com> Gerrit-Reviewer: Maulik V Vaghela <maulik.v.vaghela(a)intel.com> Gerrit-Reviewer: Meera Ravindranath <meera.ravindranath(a)intel.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Reviewer: Rizwan Qureshi <rizwan.qureshi(a)intel.com> Gerrit-Reviewer: Selma Bensaid <selma.bensaid(a)intel.com> Gerrit-Reviewer: Srinidhi N Kaushik <srinidhi.n.kaushik(a)intel.com> Gerrit-Reviewer: Subrata Banik <subrata.banik(a)intel.com> Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)google.com> Gerrit-Reviewer: V Sowmya <v.sowmya(a)intel.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Bora Guvendik <bora.guvendik(a)intel.com> Gerrit-Attention: V Sowmya <v.sowmya(a)intel.com> Gerrit-Attention: Furquan Shaikh <furquan(a)google.com> Gerrit-Attention: Maulik V Vaghela <maulik.v.vaghela(a)intel.com> Gerrit-Attention: Rizwan Qureshi <rizwan.qureshi(a)intel.com> Gerrit-Attention: Subrata Banik <subrata.banik(a)intel.com> Gerrit-Attention: Meera Ravindranath <meera.ravindranath(a)intel.com> Gerrit-Attention: Bernardo Perez Priego <bernardo.perez.priego(a)intel.com> Gerrit-Attention: Tim Wawrzynczak <twawrzynczak(a)google.com> Gerrit-Attention: Ronak Kanabar <ronak.kanabar(a)intel.com> Gerrit-Attention: Srinidhi N Kaushik <srinidhi.n.kaushik(a)intel.com> Gerrit-Attention: Patrick Rudolph <siro(a)das-labor.org> Gerrit-MessageType: newpatchset

1 0

Change in coreboot[master]: vboot: Add VB2_CONTEXT_TRUSTED
by Daisuke Nojiri (Code Review) 14 May '21

14 May '21

Attention is currently required from: Joel Kitching, Furquan Shaikh, Aaron Durbin. Daisuke Nojiri has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/54099 ) Change subject: vboot: Add VB2_CONTEXT_TRUSTED ...................................................................... Patch Set 3: (1 comment) File src/security/vboot/vboot_logic.c: https://review.coreboot.org/c/coreboot/+/54099/comment/fa8b76f1_5a29433a PS3, Line 216: EC_EFS_BOOT_MODE_NO_BOOT > In my opinion, we should update the name of the boot modes to: […] I'm ok with the suggested names. How about TRUSTED_RO, UNTRUSTED_RO, and VERIFIED_RW? Julius? -- To view, visit https://review.coreboot.org/c/coreboot/+/54099 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I9fa09dd7ae5baa1efb4e1ed4f0fe9a6803167c93 Gerrit-Change-Number: 54099 Gerrit-PatchSet: 3 Gerrit-Owner: Daisuke Nojiri <dnojiri(a)chromium.org> Gerrit-Reviewer: Aaron Durbin <adurbin(a)chromium.org> Gerrit-Reviewer: Joel Kitching <kitching(a)google.com> Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Furquan Shaikh <furquan(a)google.com> Gerrit-Attention: Joel Kitching <kitching(a)google.com> Gerrit-Attention: Furquan Shaikh <furquan(a)google.com> Gerrit-Attention: Aaron Durbin <adurbin(a)chromium.org> Gerrit-Comment-Date: Sat, 15 May 2021 03:32:33 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Furquan Shaikh <furquan(a)google.com> Gerrit-MessageType: comment

1 0

Change in coreboot[master]: vboot: Add VB2_CONTEXT_TRUSTED
by Furquan Shaikh (Code Review) 14 May '21

14 May '21

Attention is currently required from: Joel Kitching, Daisuke Nojiri, Aaron Durbin. Furquan Shaikh has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/54099 ) Change subject: vboot: Add VB2_CONTEXT_TRUSTED ...................................................................... Patch Set 3: (1 comment) File src/security/vboot/vboot_logic.c: https://review.coreboot.org/c/coreboot/+/54099/comment/b94fe517_8cfdef95 PS3, Line 216: EC_EFS_BOOT_MODE_NO_BOOT In my opinion, we should update the name of the boot modes to: ``` EC_EFS_BOOT_MODE_TRUSTED_RO EC_EFS_BOOT_MODE_UNTRUSTED_RO EC_EFS_BOOT_MODE_RW ``` With this, it is clear that the EC is basically communicating its current boot mode to GSC. What policies are implemented doesn't really matter to EC or even the GSC. AP can use the information about the current boot mode from the GSC and then apply policies like: VB2_CONTEXT_NO_BOOT(if currently in untrusted RO) or VB2_CONTEXT_TRUSTED (if in trusted RO). From EC's standpoint, RO can set boot mode to UNTRUSTED_RO if it is enabling PD or for any other reason in the future that is considered as making the EC-RO untrusted. -- To view, visit https://review.coreboot.org/c/coreboot/+/54099 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I9fa09dd7ae5baa1efb4e1ed4f0fe9a6803167c93 Gerrit-Change-Number: 54099 Gerrit-PatchSet: 3 Gerrit-Owner: Daisuke Nojiri <dnojiri(a)chromium.org> Gerrit-Reviewer: Aaron Durbin <adurbin(a)chromium.org> Gerrit-Reviewer: Joel Kitching <kitching(a)google.com> Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Furquan Shaikh <furquan(a)google.com> Gerrit-Attention: Joel Kitching <kitching(a)google.com> Gerrit-Attention: Daisuke Nojiri <dnojiri(a)chromium.org> Gerrit-Attention: Aaron Durbin <adurbin(a)chromium.org> Gerrit-Comment-Date: Sat, 15 May 2021 01:45:28 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Gerrit-MessageType: comment

1 0

Change in coreboot[master]: vboot: Add VB2_CONTEXT_TRUSTED
by Daisuke Nojiri (Code Review) 14 May '21

14 May '21

Attention is currently required from: Joel Kitching, Daisuke Nojiri, Aaron Durbin. Hello build bot (Jenkins), Joel Kitching, Julius Werner, Aaron Durbin, I'd like you to reexamine a change. Please visit https://review.coreboot.org/c/coreboot/+/54099 to look at the new patch set (#3). Change subject: vboot: Add VB2_CONTEXT_TRUSTED ...................................................................... vboot: Add VB2_CONTEXT_TRUSTED This patch makes coreboot set VB2_CONTEXT_TRUSTED based on the boot mode read from the GSC. Vboot will check VB2_CONTEXT_TRUSTED to determine whether it can start a recovery or not. BUG=b:180927027, b:187871195 BRANCH=none TEST=build Signed-off-by: Daisuke Nojiri <dnojiri(a)chromium.org> Change-Id: I9fa09dd7ae5baa1efb4e1ed4f0fe9a6803167c93 --- M src/security/vboot/vboot_logic.c 1 file changed, 8 insertions(+), 3 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/99/54099/3 -- To view, visit https://review.coreboot.org/c/coreboot/+/54099 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I9fa09dd7ae5baa1efb4e1ed4f0fe9a6803167c93 Gerrit-Change-Number: 54099 Gerrit-PatchSet: 3 Gerrit-Owner: Daisuke Nojiri <dnojiri(a)chromium.org> Gerrit-Reviewer: Aaron Durbin <adurbin(a)chromium.org> Gerrit-Reviewer: Joel Kitching <kitching(a)google.com> Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Joel Kitching <kitching(a)google.com> Gerrit-Attention: Daisuke Nojiri <dnojiri(a)chromium.org> Gerrit-Attention: Aaron Durbin <adurbin(a)chromium.org> Gerrit-MessageType: newpatchset

1 0

Change in coreboot[master]: vboot/secdata_mock: Make v0 kernel secdata context
by Aseda Aboagye (Code Review) 14 May '21

14 May '21

Attention is currently required from: Furquan Shaikh, Julius Werner. Aseda Aboagye has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/54304 ) Change subject: vboot/secdata_mock: Make v0 kernel secdata context ...................................................................... Patch Set 2: (1 comment) File src/security/vboot/secdata_mock.c: https://review.coreboot.org/c/coreboot/+/54304/comment/161fe7f0_a8a5215b PS2, Line 32: Vboot implicitly assumes that for EFS2 (Early Firmware Selection v2) : * systems, secdata is stored between reboots. > Sorry, this still doesn't really feel accurate to me. […] My understanding was that EFS2 requires secdata kernel v1 which combined with not being able to retain data across reboots led to the issue. I guess, EFS2 requires secdata kernel v1 but not vice versa. (and the fallback path which doesn't use EFS2 also runs into this, which is what happened to me). I can use your excerpt as is. -- To view, visit https://review.coreboot.org/c/coreboot/+/54304 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Id8e81afcddadf27d9eec274f7f85ff1520315aaa Gerrit-Change-Number: 54304 Gerrit-PatchSet: 2 Gerrit-Owner: Aseda Aboagye <aaboagye(a)google.com> Gerrit-Reviewer: Aaron Durbin <adurbin(a)chromium.org> Gerrit-Reviewer: Furquan Shaikh <furquan(a)google.com> Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Furquan Shaikh <furquan(a)google.com> Gerrit-Attention: Julius Werner <jwerner(a)chromium.org> Gerrit-Comment-Date: Sat, 15 May 2021 01:32:42 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Julius Werner <jwerner(a)chromium.org> Gerrit-MessageType: comment

1 0

Change in coreboot[master]: vboot/secdata_mock: Make v0 kernel secdata context
by Aseda Aboagye (Code Review) 14 May '21

14 May '21

Attention is currently required from: Furquan Shaikh, Aseda Aboagye. Hello build bot (Jenkins), Furquan Shaikh, Julius Werner, Aaron Durbin, I'd like you to reexamine a change. Please visit https://review.coreboot.org/c/coreboot/+/54304 to look at the new patch set (#3). Change subject: vboot/secdata_mock: Make v0 kernel secdata context ...................................................................... vboot/secdata_mock: Make v0 kernel secdata context The new kernel secdata v1 stores the last read EC hash, and reboots the device during EC software sync when that hash didn't match the currently active hash on the EC (this is used with TPM_CR50 to support EC-EFS2 and pretty much a no-op for other devices). Generally, of course the whole point of secdata is always that it persists across reboots, but with MOCK_SECDATA we can't do that. Previously we always happened to somewhat get away with presenting freshly-reinitialized data for MOCK_SECDATA on every boot, but with the EC hash feature in secdata v1, that would cause a reboot loop. The simplest solution is to just pretend we're a secdata v0 device when using MOCK_SECDATA. This was encountered on using a firmware built with MOCK_SECDATA but had EC software sync enabled. BUG=b:187843114 BRANCH=None TEST=`USE=mocktpm cros build-ap -b keeby`; Flash keeby device, verify that DUT does not continuously reboot with EC software sync enabled. Signed-off-by: Aseda Aboagye <aaboagye(a)google.com> Change-Id: Id8e81afcddadf27d9eec274f7f85ff1520315aaa --- M src/security/vboot/secdata_mock.c 1 file changed, 13 insertions(+), 1 deletion(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/04/54304/3 -- To view, visit https://review.coreboot.org/c/coreboot/+/54304 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Id8e81afcddadf27d9eec274f7f85ff1520315aaa Gerrit-Change-Number: 54304 Gerrit-PatchSet: 3 Gerrit-Owner: Aseda Aboagye <aaboagye(a)google.com> Gerrit-Reviewer: Aaron Durbin <adurbin(a)chromium.org> Gerrit-Reviewer: Furquan Shaikh <furquan(a)google.com> Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Furquan Shaikh <furquan(a)google.com> Gerrit-Attention: Aseda Aboagye <aaboagye(a)google.com> Gerrit-MessageType: newpatchset

1 0

Change in coreboot[master]: vboot/secdata_tpm: Create FWMP space in coreboot
by Julius Werner (Code Review) 14 May '21

14 May '21

Attention is currently required from: Andrey Pronin, Joel Kitching, Aseda Aboagye, Aaron Durbin. Julius Werner has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/52919 ) Change subject: vboot/secdata_tpm: Create FWMP space in coreboot ...................................................................... Patch Set 8: (2 comments) File src/security/vboot/secdata_tpm.c: https://review.coreboot.org/c/coreboot/+/52919/comment/8102ad49_bfcc80d3 PS1, Line 420: /* : * Set initial values of secdata_firmware space. : * kernel space is created in _factory_initialize_tpm(). : */ : vb2api_secdata_firmware_create(ctx); > to have some defaults if tlcl_self_test_full() or _factory_initialize_tpm() fail? Actually, it's better not to. Not having valid data in those spaces is the way we tell vboot that something went wrong reading them. (I guess this isn't really perfect but it should be good enough in practice... with this new "create immediately before writing" scheme, we would probably notice connection problems for one of the other spaces and then not even get to the part for creating the firmware space, and vboot would notice that one quickly.) File src/security/vboot/secdata_tpm.c: https://review.coreboot.org/c/coreboot/+/52919/comment/7af247ef_418d49bf PS7, Line 13: <security/tpm/tss/tcg-2.0/tss_structures.h> > curious: how did it work before this? we were already pulling TPMA_NV_* from somewhere... […] Actually, tss.h already chain-includes these. Not sure if it's intended to also include these directly, but it doesn't hurt. (When to rely on chain includes and when not to is not perfectly well-defined for all cases and also a frequent cause of contention between coreboot developers.) -- To view, visit https://review.coreboot.org/c/coreboot/+/52919 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I1f566e00f11046ff9a9891c65660af50fbb83675 Gerrit-Change-Number: 52919 Gerrit-PatchSet: 8 Gerrit-Owner: Aseda Aboagye <aaboagye(a)google.com> Gerrit-Reviewer: Aaron Durbin <adurbin(a)chromium.org> Gerrit-Reviewer: Andrey Pronin <apronin(a)chromium.org> Gerrit-Reviewer: Joel Kitching <kitching(a)google.com> Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Andrey Pronin <apronin(a)chromium.org> Gerrit-Attention: Joel Kitching <kitching(a)google.com> Gerrit-Attention: Aseda Aboagye <aaboagye(a)google.com> Gerrit-Attention: Aaron Durbin <adurbin(a)chromium.org> Gerrit-Comment-Date: Sat, 15 May 2021 01:14:19 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Andrey Pronin <apronin(a)chromium.org> Comment-In-Reply-To: Julius Werner <jwerner(a)chromium.org> Comment-In-Reply-To: Aseda Aboagye <aaboagye(a)google.com> Gerrit-MessageType: comment

1 0

Change in coreboot[master]: vboot/secdata_tpm: Rename set_space()
by Julius Werner (Code Review) 14 May '21

14 May '21

Attention is currently required from: Aseda Aboagye, Aaron Durbin. Julius Werner has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/54308 ) Change subject: vboot/secdata_tpm: Rename set_space() ...................................................................... Patch Set 3: Code-Review+2 -- To view, visit https://review.coreboot.org/c/coreboot/+/54308 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I80a8342c51d7bfaa0cb2eb3fd37240425d5901be Gerrit-Change-Number: 54308 Gerrit-PatchSet: 3 Gerrit-Owner: Aseda Aboagye <aaboagye(a)google.com> Gerrit-Reviewer: Aaron Durbin <adurbin(a)chromium.org> Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Aseda Aboagye <aaboagye(a)google.com> Gerrit-Attention: Aaron Durbin <adurbin(a)chromium.org> Gerrit-Comment-Date: Sat, 15 May 2021 01:07:36 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

Change in coreboot[master]: vboot/secdata_mock: Make v0 kernel secdata context
by Julius Werner (Code Review) 14 May '21

14 May '21

Attention is currently required from: Furquan Shaikh, Aseda Aboagye. Julius Werner has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/54304 ) Change subject: vboot/secdata_mock: Make v0 kernel secdata context ...................................................................... Patch Set 2: (2 comments) File src/security/vboot/secdata_mock.c: https://review.coreboot.org/c/coreboot/+/54304/comment/f680e3bd_4dd1a379 PS1, Line 31: /* Vboot implicitly assumes that EFS2 (Early Firmware Selection v2) is > Thank you. I'd never seen the latter before so I got confused. You should've been here for the great comment style wars of 2018. Some people really care *a lot* about where asterisks should and shouldn't go. ;) File src/security/vboot/secdata_mock.c: https://review.coreboot.org/c/coreboot/+/54304/comment/6bad5129_589349d4 PS2, Line 32: Vboot implicitly assumes that for EFS2 (Early Firmware Selection v2) : * systems, secdata is stored between reboots. Sorry, this still doesn't really feel accurate to me. vboot always assumes that secdata is stored between reboots (that's the whole point of having it). secdata v1 is where it really prevents you from booting when you don't. EFS2 isn't really the main issue here. How about > The new kernel secdata v1 stores the last read EC hash, and reboots the device during EC software sync when that hash didn't match the currently active hash on the EC (this is used with TPM_CR50 to support EC-EFS2 and pretty much a no-op for other devices). Generally, of course the whole point of secdata is always that it persists across reboots, but with MOCK_SECDATA we can't do that. Previously we always happened to somewhat get away with presenting freshly-reinitialized data for MOCK_SECDATA on every boot, but with the EC hash feature in secdata v1, that would cause a reboot loop. The simplest solution is to just pretend we're a secdata v0 device when using MOCK_SECDATA. -- To view, visit https://review.coreboot.org/c/coreboot/+/54304 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Id8e81afcddadf27d9eec274f7f85ff1520315aaa Gerrit-Change-Number: 54304 Gerrit-PatchSet: 2 Gerrit-Owner: Aseda Aboagye <aaboagye(a)google.com> Gerrit-Reviewer: Aaron Durbin <adurbin(a)chromium.org> Gerrit-Reviewer: Furquan Shaikh <furquan(a)google.com> Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Furquan Shaikh <furquan(a)google.com> Gerrit-Attention: Aseda Aboagye <aaboagye(a)google.com> Gerrit-Comment-Date: Sat, 15 May 2021 01:06:41 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Aseda Aboagye <aaboagye(a)google.com> Comment-In-Reply-To: Julius Werner <jwerner(a)chromium.org> Gerrit-MessageType: comment

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

coreboot-gerrit May 2021