coreboot-gerrit April 2022

coreboot-gerrit@coreboot.org

1 participants
5879 discussions

Change in coreboot[master]: soc/intel/cmn/pch/lockdown: Implement LPC lock down configuration
by Werner Zeh (Code Review) 14 Apr '22

14 Apr '22

Attention is currently required from: Subrata Banik, Tim Wawrzynczak, Angel Pons, Arthur Heymans, Eric Lai, Lean Sheng Tan. Werner Zeh has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/63630 ) Change subject: soc/intel/cmn/pch/lockdown: Implement LPC lock down configuration ...................................................................... Patch Set 1: (1 comment) File src/soc/intel/common/pch/lockdown/lockdown.c: https://review.coreboot.org/c/coreboot/+/63630/comment/e1445e7c_404736c3 PS1, Line 94: static void lpc_lockdown_config(int chipset_lockdown) : { : /* Set BIOS Interface Lock, BIOS Lock */ : if (chipset_lockdown == CHIPSET_LOCKDOWN_COREBOOT) { : /* BIOS Interface Lock */ : lpc_set_bios_interface_lock_down(); : : /* Only allow writes in SMM */ : if (CONFIG(BOOTMEDIA_SMM_BWP)) : lpc_set_eiss(); : : /* BIOS Lock */ : lpc_set_lock_enable(); : } : } > > This generic code is executed even by platforms where there is no LPC at all (for instance elkhart […] OK, saw this link (LPC<->eSPI) now on EHL, too. Sorry for the confusion. -- To view, visit https://review.coreboot.org/c/coreboot/+/63630 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I3e49b783e5db0ff40238e6e9259e48a4ecca66f8 Gerrit-Change-Number: 63630 Gerrit-PatchSet: 1 Gerrit-Owner: Subrata Banik <subratabanik(a)google.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Reviewer: Eric Lai <eric_lai(a)quanta.corp-partner.google.com> Gerrit-Reviewer: Lean Sheng Tan <sheng.tan(a)9elements.com> Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Reviewer: Werner Zeh <werner.zeh(a)siemens.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Subrata Banik <subratabanik(a)google.com> Gerrit-Attention: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Attention: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Attention: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Attention: Eric Lai <eric_lai(a)quanta.corp-partner.google.com> Gerrit-Attention: Lean Sheng Tan <sheng.tan(a)9elements.com> Gerrit-Comment-Date: Thu, 14 Apr 2022 13:44:56 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Subrata Banik <subratabanik(a)google.com> Comment-In-Reply-To: Werner Zeh <werner.zeh(a)siemens.com> Gerrit-MessageType: comment

1 0

Change in coreboot[master]: soc/intel/cmn/pch/lockdown: Implement LPC lock down configuration
by Subrata Banik (Code Review) 14 Apr '22

14 Apr '22

Attention is currently required from: Tim Wawrzynczak, Angel Pons, Arthur Heymans, Eric Lai, Lean Sheng Tan, Werner Zeh. Subrata Banik has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/63630 ) Change subject: soc/intel/cmn/pch/lockdown: Implement LPC lock down configuration ...................................................................... Patch Set 1: (1 comment) File src/soc/intel/common/pch/lockdown/lockdown.c: https://review.coreboot.org/c/coreboot/+/63630/comment/2724b985_1118fad7 PS1, Line 94: static void lpc_lockdown_config(int chipset_lockdown) : { : /* Set BIOS Interface Lock, BIOS Lock */ : if (chipset_lockdown == CHIPSET_LOCKDOWN_COREBOOT) { : /* BIOS Interface Lock */ : lpc_set_bios_interface_lock_down(); : : /* Only allow writes in SMM */ : if (CONFIG(BOOTMEDIA_SMM_BWP)) : lpc_set_eiss(); : : /* BIOS Lock */ : lpc_set_lock_enable(); : } : } > This generic code is executed even by platforms where there is no LPC at all (for instance elkhartlake). How is the behavior on these platforms? I hope you mean, LPC is not there but eSPI is there. From ICL, LPC registers are now renamed with eSPI and register snapshot is same, hence, this lockdown configuration is relevant for latest platform as well. Let me put a comment as well to make it explicit. -- To view, visit https://review.coreboot.org/c/coreboot/+/63630 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I3e49b783e5db0ff40238e6e9259e48a4ecca66f8 Gerrit-Change-Number: 63630 Gerrit-PatchSet: 1 Gerrit-Owner: Subrata Banik <subratabanik(a)google.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Reviewer: Eric Lai <eric_lai(a)quanta.corp-partner.google.com> Gerrit-Reviewer: Lean Sheng Tan <sheng.tan(a)9elements.com> Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Reviewer: Werner Zeh <werner.zeh(a)siemens.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Attention: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Attention: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Attention: Eric Lai <eric_lai(a)quanta.corp-partner.google.com> Gerrit-Attention: Lean Sheng Tan <sheng.tan(a)9elements.com> Gerrit-Attention: Werner Zeh <werner.zeh(a)siemens.com> Gerrit-Comment-Date: Thu, 14 Apr 2022 13:38:55 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Werner Zeh <werner.zeh(a)siemens.com> Gerrit-MessageType: comment

1 0

Change in coreboot[master]: soc/intel/cmn/pch/lockdown: Implement LPC lock down configuration
by Werner Zeh (Code Review) 14 Apr '22

14 Apr '22

Attention is currently required from: Subrata Banik, Tim Wawrzynczak, Angel Pons, Arthur Heymans, Eric Lai, Lean Sheng Tan. Werner Zeh has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/63630 ) Change subject: soc/intel/cmn/pch/lockdown: Implement LPC lock down configuration ...................................................................... Patch Set 1: (1 comment) File src/soc/intel/common/pch/lockdown/lockdown.c: https://review.coreboot.org/c/coreboot/+/63630/comment/a0d348ac_282cb27f PS1, Line 94: static void lpc_lockdown_config(int chipset_lockdown) : { : /* Set BIOS Interface Lock, BIOS Lock */ : if (chipset_lockdown == CHIPSET_LOCKDOWN_COREBOOT) { : /* BIOS Interface Lock */ : lpc_set_bios_interface_lock_down(); : : /* Only allow writes in SMM */ : if (CONFIG(BOOTMEDIA_SMM_BWP)) : lpc_set_eiss(); : : /* BIOS Lock */ : lpc_set_lock_enable(); : } : } This generic code is executed even by platforms where there is no LPC at all (for instance elkhartlake). How is the behavior on these platforms? -- To view, visit https://review.coreboot.org/c/coreboot/+/63630 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I3e49b783e5db0ff40238e6e9259e48a4ecca66f8 Gerrit-Change-Number: 63630 Gerrit-PatchSet: 1 Gerrit-Owner: Subrata Banik <subratabanik(a)google.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Reviewer: Eric Lai <eric_lai(a)quanta.corp-partner.google.com> Gerrit-Reviewer: Lean Sheng Tan <sheng.tan(a)9elements.com> Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Reviewer: Werner Zeh <werner.zeh(a)siemens.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Subrata Banik <subratabanik(a)google.com> Gerrit-Attention: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Attention: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Attention: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Attention: Eric Lai <eric_lai(a)quanta.corp-partner.google.com> Gerrit-Attention: Lean Sheng Tan <sheng.tan(a)9elements.com> Gerrit-Comment-Date: Thu, 14 Apr 2022 13:32:43 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Gerrit-MessageType: comment

1 0

Change in coreboot[master]: soc/intel/cmn/pch/lockdown: Perform additional SPI lock configuration
by Werner Zeh (Code Review) 14 Apr '22

14 Apr '22

Attention is currently required from: Subrata Banik, Tim Wawrzynczak, Angel Pons, Arthur Heymans, Lean Sheng Tan. Werner Zeh has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/63627 ) Change subject: soc/intel/cmn/pch/lockdown: Perform additional SPI lock configuration ...................................................................... Patch Set 6: Code-Review+2 -- To view, visit https://review.coreboot.org/c/coreboot/+/63627 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I922db8b46ac0d0523b91fc5aced88e38c8d8a560 Gerrit-Change-Number: 63627 Gerrit-PatchSet: 6 Gerrit-Owner: Subrata Banik <subratabanik(a)google.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Reviewer: Eric Lai <eric_lai(a)quanta.corp-partner.google.com> Gerrit-Reviewer: Lean Sheng Tan <sheng.tan(a)9elements.com> Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Reviewer: Werner Zeh <werner.zeh(a)siemens.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Subrata Banik <subratabanik(a)google.com> Gerrit-Attention: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Attention: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Attention: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Attention: Lean Sheng Tan <sheng.tan(a)9elements.com> Gerrit-Comment-Date: Thu, 14 Apr 2022 13:26:34 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

Change in coreboot[master]: soc/intel/cmn/fast_spi: Add API to set SPI controller VCL
by Werner Zeh (Code Review) 14 Apr '22

14 Apr '22

Attention is currently required from: Subrata Banik, Tim Wawrzynczak, Angel Pons, Arthur Heymans, Lean Sheng Tan. Werner Zeh has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/63626 ) Change subject: soc/intel/cmn/fast_spi: Add API to set SPI controller VCL ...................................................................... Patch Set 5: Code-Review+2 -- To view, visit https://review.coreboot.org/c/coreboot/+/63626 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Ie9a12db1bab81779fd8e7db90221d08da3c65011 Gerrit-Change-Number: 63626 Gerrit-PatchSet: 5 Gerrit-Owner: Subrata Banik <subratabanik(a)google.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Reviewer: Eric Lai <eric_lai(a)quanta.corp-partner.google.com> Gerrit-Reviewer: Lean Sheng Tan <sheng.tan(a)9elements.com> Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Reviewer: Werner Zeh <werner.zeh(a)siemens.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Subrata Banik <subratabanik(a)google.com> Gerrit-Attention: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Attention: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Attention: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Attention: Lean Sheng Tan <sheng.tan(a)9elements.com> Gerrit-Comment-Date: Thu, 14 Apr 2022 13:25:54 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

Change in coreboot[master]: soc/intel/cmn/fast_spi: Add API to clear outstanding SPI status
by Werner Zeh (Code Review) 14 Apr '22

14 Apr '22

Attention is currently required from: Subrata Banik, Tim Wawrzynczak, Angel Pons, Arthur Heymans, Lean Sheng Tan. Werner Zeh has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/63625 ) Change subject: soc/intel/cmn/fast_spi: Add API to clear outstanding SPI status ...................................................................... Patch Set 3: Code-Review+2 -- To view, visit https://review.coreboot.org/c/coreboot/+/63625 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I62adba0d0cef1d4c53b24800f90b4fe76a9d78b7 Gerrit-Change-Number: 63625 Gerrit-PatchSet: 3 Gerrit-Owner: Subrata Banik <subratabanik(a)google.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Reviewer: Eric Lai <eric_lai(a)quanta.corp-partner.google.com> Gerrit-Reviewer: Lean Sheng Tan <sheng.tan(a)9elements.com> Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Reviewer: Werner Zeh <werner.zeh(a)siemens.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Subrata Banik <subratabanik(a)google.com> Gerrit-Attention: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Attention: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Attention: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Attention: Lean Sheng Tan <sheng.tan(a)9elements.com> Gerrit-Comment-Date: Thu, 14 Apr 2022 13:25:12 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

Change in coreboot[master]: soc/intel/cmn/fast_spi: Add API to check if SPI Cycle In Progress
by Werner Zeh (Code Review) 14 Apr '22

14 Apr '22

Attention is currently required from: Subrata Banik, Tim Wawrzynczak, Angel Pons, Arthur Heymans, Lean Sheng Tan. Werner Zeh has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/63624 ) Change subject: soc/intel/cmn/fast_spi: Add API to check if SPI Cycle In Progress ...................................................................... Patch Set 3: Code-Review+2 -- To view, visit https://review.coreboot.org/c/coreboot/+/63624 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Ibd3f67ae60bfcb3610cd0950b057da97ff74b5b9 Gerrit-Change-Number: 63624 Gerrit-PatchSet: 3 Gerrit-Owner: Subrata Banik <subratabanik(a)google.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Reviewer: Eric Lai <eric_lai(a)quanta.corp-partner.google.com> Gerrit-Reviewer: Lean Sheng Tan <sheng.tan(a)9elements.com> Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Reviewer: Werner Zeh <werner.zeh(a)siemens.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Subrata Banik <subratabanik(a)google.com> Gerrit-Attention: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Attention: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Attention: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Attention: Lean Sheng Tan <sheng.tan(a)9elements.com> Gerrit-Comment-Date: Thu, 14 Apr 2022 13:24:50 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

Change in coreboot[master]: Add SBOM (Software Bill of Materials) Generation
by Maximilian Brune (Code Review) 14 Apr '22

14 Apr '22

Maximilian Brune has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/63639 ) Change subject: Add SBOM (Software Bill of Materials) Generation ...................................................................... Add SBOM (Software Bill of Materials) Generation Add Makefile.inc to Generate and build coswid tags Add templates for most payloads, coreboot and intel-microcode Add Kconfig entries to optionaly add coswid tags for payloads, coreboot and intel microcode Add CBFS entry called sbom to each build via Makefile.inc Signed-off-by: Maximilian Brune <code.ivng5(a)simplelogin.co> Change-Id: Icb7481d4903f95d200eddbfed7728fbec51819d0 --- M Makefile.inc M payloads/Kconfig M src/Kconfig A src/sbom/Makefile.inc A src/sbom/coreboot.ini.src A src/sbom/intel-microcode.ini.src A src/sbom/payload-BOOTBOOT.ini.src A src/sbom/payload-FILO.ini.src A src/sbom/payload-GRUB2.ini.src A src/sbom/payload-LinuxBoot.ini.src A src/sbom/payload-SeaBIOS.ini.src A src/sbom/payload-U-Boot.ini.src A src/sbom/payload-Yabits.ini.src A src/sbom/payload-depthcharge.ini.src A src/sbom/payload-iPXE.ini.src A src/sbom/payload-skiboot.ini.src M src/southbridge/intel/common/firmware/Kconfig 17 files changed, 318 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/39/63639/1 diff --git a/Makefile.inc b/Makefile.inc index 6b1c45c..f438136 100644 --- a/Makefile.inc +++ b/Makefile.inc @@ -93,6 +93,7 @@ subdirs-y += src/mainboard/$(MAINBOARDDIR) subdirs-y += src/security subdirs-y += payloads payloads/external +subdirs-y += src/sbom subdirs-y += site-local subdirs-y += util/checklist util/testing diff --git a/payloads/Kconfig b/payloads/Kconfig index 386b207..f69f091 100644 --- a/payloads/Kconfig +++ b/payloads/Kconfig @@ -54,6 +54,30 @@ help The path and filename of the ELF executable file to use as payload. +config PAYLOAD_SBOM + bool "Include payload uswid tag into SBOM file" + default y + help + Select this option if you want to include a coswid (Concise Software Identification Tag) + of the payload into the SBOM (Software Bill of Materials) File in your build + +config PAYLOAD_SBOM_GENERATE + bool "Generate SBOM file" + depends on PAYLOAD_SBOM && !(PAYLOAD_ELF || PAYLOAD_FIT || PAYLOAD_LINUX) + default y + help + Select this option if you want coreboot to generate and include + the coswid (Concise Software Identification Tag) instead of supplying it manually. + Be aware that this option is only meant to be a transition and suppliers of Software + should always prefer to include their own Software descriptions, since ours may be + incomplete or straight up wrong. + +config PAYLOAD_SBOM_PATH + string "SBOM file path" + depends on PAYLOAD_SBOM && !PAYLOAD_SBOM_GENERATE + help + The path of the .ini file describing the payload Software included in the build + choice prompt "Payload compression algorithm" default COMPRESSED_PAYLOAD_LZMA diff --git a/src/Kconfig b/src/Kconfig index d57ce90..4dc24a4 100644 --- a/src/Kconfig +++ b/src/Kconfig @@ -426,6 +426,13 @@ override other sources and allow the local image to preempt the mainboard selected source and can be used for other FW_CONFIG_SOURCEs fallback option. +config COREBOOT_SBOM + bool "Generate SBOM data for coreboot" + default y + help + Select this option if you want to include a coswid (Concise Software Identification Tag) + of the corebot itself into the SBOM (Software Bill of Materials) File in your build + config HAVE_RAMPAYLOAD bool diff --git a/src/sbom/Makefile.inc b/src/sbom/Makefile.inc new file mode 100644 index 0000000..cb546c4 --- /dev/null +++ b/src/sbom/Makefile.inc @@ -0,0 +1,104 @@ +obj ?= build +src ?= src +build-dir = $(obj)/sbom +src-dir = $(src)/sbom + +ifeq ($(CONFIG_PAYLOAD_SBOM), y) +ifeq ($(CONFIG_PAYLOAD_SBOM_GENERATE), y) +payload-git-dir-$(CONFIG_PAYLOAD_BOOTBOOT) = payloads/external/BOOTBOOT/bootboot +payload-git-dir-$(CONFIG_PAYLOAD_DEPTHCHARGE) = payloads/external/depthcharge/depthcharge +payload-git-dir-$(CONFIG_PAYLOAD_FILO) = payloads/external/FILO/filo +payload-git-dir-$(CONFIG_PAYLOAD_GRUB2) = payloads/external/GRUB2/grub2 +payload-git-dir-$(CONFIG_PAYLOAD_LINUXBOOT) = payloads/external/LinuxBoot/linuxboot +payload-git-dir-$(CONFIG_PAYLOAD_SEABIOS) = payloads/external/SeaBIOS/seabios +payload-git-dir-$(CONFIG_PAYLOAD_SKIBOOT) = payloads/external/skiboot/skiboot +#payload-git-dir-$(CONFIG_PAYLOAD_TIANOCORE) = payloads/external/tianocore/ +payload-git-dir-$(CONFIG_PAYLOAD_UBOOT) = payloads/external/U-Boot/u-boot +payload-git-dir-$(CONFIG_PAYLOAD_YABITS) = payloads/external/Yabits/uefi +payload-git-dir-$(CONFIG_PAYLOAD_IPXE) = payloads/external/iPXE/ipxe +# e.g. payloads/external/SeaBIOS/seabios -> $(build-dir)/SeaBIOS.uswid +payload-uswid-file = $(build-dir)/payload-$(subst /,,$(dir $(patsubst payloads/external/%,%,$(payload-git-dir-y)))).uswid +payload-ini-file = $(patsubst %.uswid,%.ini,$(payload-uswid-file)) +payload-ini-src-file = $(patsubst $(build-dir)/%.uswid,$(src-dir)/%.ini.src,$(payload-uswid-file)) +else +payload-uswid-file = $(build-dir)/payload.uswid +endif +endif + +#uswid-files-$(CONFIG_ME_SBOM) += $(build-dir)/me.uswid +#uswid-files-$(CONFIG_IFD_SBOM) += $(build-dir)/ifd.uswid +uswid-files-$(CONFIG_COREBOOT_SBOM) += $(build-dir)/coreboot.uswid + +uswid-files-y += $(patsubst 3rdparty/intel-microcode/intel-ucode/%, $(build-dir)/intel-microcode-%.uswid, $(cpu_microcode_bins)) +#TODO same for AMD microcodes + +## Build final SBOM (Software Bill of Materials) by concatinting all .uswid files + +$(build-dir)/uswid-concat.bin: $(uswid-files-y) $(payload-uswid-file) | $(build-dir) + cat $^ > $@ + +# all build files depend on the $(build-dir) directory being created +$(build-dir): + mkdir -p $(build-dir) + + +## Build all necessary .uswid files + +$(uswid-files-y) $(payload-uswid-file): $(build-dir)/%.uswid: $(build-dir)/%.ini | $(build-dir) + uswid --load $< --save $@ + + +## Generate all .ini files + +$(build-dir)/coreboot.ini: $(src-dir)/coreboot.ini.src .git/HEAD + cp $< $@;\ + git_tree_hash=$$(git log -n 1 --format=%T);\ + git_comm_hash=$$(git log -n 1 --format=%H);\ + sed -i -e "s/<colloquial_version>/$$git_tree_hash/" -e "s/<software_version>/$$git_comm_hash/" $@;\ + +ifeq ($(CONFIG_IFD_SBOM_GENERATE), y) +$(build-dir)/ifd.ini: $(src-dir)/ifd.ini.src $(IFD_BIN_PATH) | $(build-dir) + cp $< $@ + #TODO generate Intel Flash descriptor sbom data +else +$(build-dir)/ifd.ini: $(call strip_quotes, $(CONFIG_IFD_SBOM_PATH)) | $(build-dir) + cp $< $@ +endif + +ifeq ($(CONFIG_ME_SBOM_GENERATE), y) +$(build-dir)/me.ini: $(src-dir)/me.ini.src $(ME_BIN_PATH) | $(build-dir) + cp $< $@ + #TODO generate Intel Management Engine sbom data +else +$(build-dir)/me.ini: $(call strip_quotes, $(CONFIG_ME_SBOM_PATH)) | $(build-dir) + cp $< $@ +endif + +$(build-dir)/intel-microcode-%.ini: $(src-dir)/intel-microcode.ini.src 3rdparty/intel-microcode/intel-ucode/% | $(build-dir) + cp $< $@ + year=$$(hexdump --skip 8 --length 2 --format '"%04x"' $(word 2,$^));\ + day=$$(hexdump --skip 10 --length 1 --format '"%02x"' $(word 2,$^));\ + month=$$(hexdump --skip 11 --length 1 --format '"%02x"' $(word 2,$^));\ + echo "/$*:$$year-$$month-$$day/ Microcode bins: $(cpu_microcode_bins)";\ + sed -i "s/<software_version>/$*:$$year-$$month-$$day/" $@ + +$(build-dir)/amd-microcode-%.ini: $(src-dir)/amd-microcode.ini.src dosomething | $(build-dir) + cp $< $@ + echo Microcode bins: $(cpu_microcode_bins) + echo Firmware Location: $(FIRMWARE_LOCATION) ${FIRMWARE_LOCATION} + +ifeq ($(CONFIG_PAYLOAD_SBOM_GENERATE), y) +$(payload-ini-file): $(payload-ini-src-file) $(payload-git-dir-y)/.git | $(build-dir) + cp $< $@;\ + git_tree_hash=$$(git --git-dir $(word 2,$^) log -n 1 --format=%T);\ + git_comm_hash=$$(git --git-dir $(word 2,$^) log -n 1 --format=%H);\ + sed -i -e "s/<colloquial_version>/$$git_tree_hash/" -e "s/<software_version>/$$git_comm_hash/" $@; +else +$(build-dir)/payload.ini: $(call strip_quotes, $(CONFIG_PAYLOAD_SBOM_PATH)) + cp $< $@ +endif + +cbfs-files-y += sbom +sbom-file = $(build-dir)/uswid-concat.bin +sbom-type = raw + diff --git a/src/sbom/coreboot.ini.src b/src/sbom/coreboot.ini.src new file mode 100644 index 0000000..a547f09 --- /dev/null +++ b/src/sbom/coreboot.ini.src @@ -0,0 +1,13 @@ +[uSWID] +; uuidgen --name review.coreboot.org/coreboot.git --namespace "6ba7b811-9dad-11d1-80b4-00c04fd430c8" --sha1 +tag-id = a4eb14a7-43a5-536b-aaf4-4be142b4dc9b +software-name = Coreboot +software-version = <software_version> +product = Coreboot +summary = coreboot is a project to develop open source boot firmware for various architectures. +colloquial-version = <colloquial_version> + +[uSWID-Entity:TagCreator] +name = 9elements +regid = 9elements.com +;extra-roles = <extra_roles> diff --git a/src/sbom/intel-microcode.ini.src b/src/sbom/intel-microcode.ini.src new file mode 100644 index 0000000..d7f37dc --- /dev/null +++ b/src/sbom/intel-microcode.ini.src @@ -0,0 +1,12 @@ +[uSWID] +; uuidgen --name intel.com/microcode --namespace "6ba7b811-9dad-11d1-80b4-00c04fd430c8" --sha1 +tag-id = 561a5b02-27e1-56d8-9ca7-08175ced619f +software-name = Intel-Microcode +software-version = <software_version> +product = Intel-Microcode +summary = Micrcode Updates for Intel Processors + +[uSWID-Entity:TagCreator] +name = 9elements +regid = 9elements.com +;extra-roles = <extra_roles> diff --git a/src/sbom/payload-BOOTBOOT.ini.src b/src/sbom/payload-BOOTBOOT.ini.src new file mode 100644 index 0000000..aa5c1a4 --- /dev/null +++ b/src/sbom/payload-BOOTBOOT.ini.src @@ -0,0 +1,13 @@ +[uSWID] +; uuidgen --name gitlab.com/bztsrc/bootboot --namespace "6ba7b811-9dad-11d1-80b4-00c04fd430c8" --sha1 +tag-id = 1990bdb5-9393-50cc-8267-843ed0f0419d +software-name = BootBoot +software-version = <software_version> +product = BootBoot +summary = BOOTBOOT multi platform micro-kernel loader +colloquial-version = <colloquial_version> + +[uSWID-Entity:TagCreator] +name = 9elements +regid = 9elements.com +;extra-roles = <extra_roles> diff --git a/src/sbom/payload-FILO.ini.src b/src/sbom/payload-FILO.ini.src new file mode 100644 index 0000000..dfd9502 --- /dev/null +++ b/src/sbom/payload-FILO.ini.src @@ -0,0 +1,13 @@ +[uSWID] +; uuidgen --name review.coreboot.org/filo --namespace "6ba7b811-9dad-11d1-80b4-00c04fd430c8" --sha1 +tag-id = 4870d7d4-de29-5eab-af8d-511da8c984c9 +software-name = FILO +software-version = <software_version> +product = FILO +summary = FILO is a bootloader which loads boot images from a local filesystem, without help from legacy BIOS services +colloquial-version = <colloquial_version> + +[uSWID-Entity:TagCreator] +name = 9elements +regid = 9elements.com +;extra-roles = <extra_roles> diff --git a/src/sbom/payload-GRUB2.ini.src b/src/sbom/payload-GRUB2.ini.src new file mode 100644 index 0000000..2a85b51 --- /dev/null +++ b/src/sbom/payload-GRUB2.ini.src @@ -0,0 +1,13 @@ +[uSWID] +; uuidgen --name savannah.gnu.org/projects/grub --namespace "6ba7b811-9dad-11d1-80b4-00c04fd430c8" --sha1 +tag-id = de008f0f-b80c-56f5-b9fa-54fbdcf87f5a +software-name = GRUB2 +software-version = <software_version> +product = GRUB2 +summary = GNU GRUB is a boot loader, which can load a wide variety of free operating systems, as well as proprietary operating systems with chain-loading +colloquial-version = <colloquial_version> + +[uSWID-Entity:TagCreator] +name = 9elements +regid = 9elements.com +;extra-roles = <extra_roles> diff --git a/src/sbom/payload-LinuxBoot.ini.src b/src/sbom/payload-LinuxBoot.ini.src new file mode 100644 index 0000000..927151d --- /dev/null +++ b/src/sbom/payload-LinuxBoot.ini.src @@ -0,0 +1,13 @@ +[uSWID] +; uuidgen --name github.com/linuxboot/linuxboot --namespace "6ba7b811-9dad-11d1-80b4-00c04fd430c8" --sha1 +tag-id = f9c08a21-2fa3-57dc-9413-43e0be43a0df +software-name = LinuxBoot +software-version = <software_version> +product = LinuxBoot +summary = LinuxBoot is a firmware for modern servers that replaces specific firmware functionality like the UEFI DXE phase with a Linux kernel and runtime +colloquial-version = <colloquial_version> + +[uSWID-Entity:TagCreator] +name = 9elements +regid = 9elements.com +;extra-roles = <extra_roles> diff --git a/src/sbom/payload-SeaBIOS.ini.src b/src/sbom/payload-SeaBIOS.ini.src new file mode 100644 index 0000000..0252d64 --- /dev/null +++ b/src/sbom/payload-SeaBIOS.ini.src @@ -0,0 +1,13 @@ +[uSWID] +; uuidgen --name review.coreboot.org/seabios --namespace "6ba7b811-9dad-11d1-80b4-00c04fd430c8" --sha1 +tag-id = 0e79fe1b-d8b2-503d-a1b8-c9eccdba3881 +software-name = Seabios +software-version = <software_version> +product = Seabios +summary = SeaBIOS is an open-source legacy BIOS implementation which can be used as a coreboot payload. It implements the standard BIOS calling interfaces that a typical x86 proprietary BIOS implements +colloquial-version = <colloquial_version> + +[uSWID-Entity:TagCreator] +name = 9elements +regid = 9elements.com +;extra-roles = <extra_roles> diff --git a/src/sbom/payload-U-Boot.ini.src b/src/sbom/payload-U-Boot.ini.src new file mode 100644 index 0000000..4745ccf --- /dev/null +++ b/src/sbom/payload-U-Boot.ini.src @@ -0,0 +1,13 @@ +[uSWID] +; uuidgen --name source.denx.de/u-boot/u-boot --namespace "6ba7b811-9dad-11d1-80b4-00c04fd430c8" --sha1 +tag-id = fac44df7-62ec-544b-b4cf-50a522c7c463 +software-name = U-Boot +software-version = <software_version> +product = U-Boot +summary = Das U-Boot (subtitled "the Universal Boot Loader") is an open-source, primary boot loader used in embedded devices to package the instructions to boot the device's operating system kernel. +colloquial-version = <colloquial_version> + +[uSWID-Entity:TagCreator] +name = 9elements +regid = 9elements.com +;extra-roles = <extra_roles> diff --git a/src/sbom/payload-Yabits.ini.src b/src/sbom/payload-Yabits.ini.src new file mode 100644 index 0000000..a9a4351 --- /dev/null +++ b/src/sbom/payload-Yabits.ini.src @@ -0,0 +1,13 @@ +[uSWID] +; uuidgen --name github.com/yabits/uefi --namespace "6ba7b811-9dad-11d1-80b4-00c04fd430c8" --sha1 +tag-id = cd926122-1bd3-5271-94ca-40932b3a171d +software-name = yabits +software-version = <software_version> +product = yabits +summary = Fast and lightweight yet another UEFI implementation +colloquial-version = <colloquial_version> + +[uSWID-Entity:TagCreator] +name = 9elements +regid = 9elements.com +;extra-roles = <extra_roles> diff --git a/src/sbom/payload-depthcharge.ini.src b/src/sbom/payload-depthcharge.ini.src new file mode 100644 index 0000000..4e89b98 --- /dev/null +++ b/src/sbom/payload-depthcharge.ini.src @@ -0,0 +1,13 @@ +[uSWID] +; uuidgen --name chromium.googlesource.com/chromiumos/platform/depthcharge --namespace "6ba7b811-9dad-11d1-80b4-00c04fd430c8" --sha1 +tag-id = f6d08807-8c49-52d6-aa82-ba9242c309c0 +software-name = depthcharge +software-version = <software_version> +product = depthcharge +summary = Depthcharge is a toolkit designed to support security research and “jailbreaking” of embedded platforms using the Das U-Boot bootloader, herein referred to only as “U-Boot” +colloquial-version = <colloquial_version> + +[uSWID-Entity:TagCreator] +name = 9elements +regid = 9elements.com +;extra-roles = <extra_roles> diff --git a/src/sbom/payload-iPXE.ini.src b/src/sbom/payload-iPXE.ini.src new file mode 100644 index 0000000..3330943 --- /dev/null +++ b/src/sbom/payload-iPXE.ini.src @@ -0,0 +1,13 @@ +[uSWID] +; uuidgen --name github.com/ipxe/ipxe --namespace "6ba7b811-9dad-11d1-80b4-00c04fd430c8" --sha1 +tag-id = 8264e64a-facf-57cd-84e7-20c49d76cd12 +software-name = iPXE +software-version = <software_version> +product = iPXE +summary = iPXE is an open source network boot firmware. It provides a full PXE implementation enhanced with additional features. +colloquial-version = <colloquial_version> + +[uSWID-Entity:TagCreator] +name = 9elements +regid = 9elements.com +;extra-roles = <extra_roles> diff --git a/src/sbom/payload-skiboot.ini.src b/src/sbom/payload-skiboot.ini.src new file mode 100644 index 0000000..8ddbfbc --- /dev/null +++ b/src/sbom/payload-skiboot.ini.src @@ -0,0 +1,14 @@ +[uSWID] +; uuidgen --name github.com/open-power/skiboot --namespace "6ba7b811-9dad-11d1-80b4-00c04fd430c +8" --sha1 +tag-id = e4ebbda4-ef8c-5736-a28f-ac5c3a13a72d +software-name = skiboot +software-version = <software_version> +product = skiboot +summary = Skiboot is boot and runtime firmware for OpenPOWER systems. It’s loaded by earlier boot firmware (typically Hostboot). Along with loading the bootloader, it provides some runtime services to the OS (typically Linux). +colloquial-version = <colloquial_version> + +[uSWID-Entity:TagCreator] +name = 9elements +regid = 9elements.com +;extra-roles = <extra_roles> diff --git a/src/southbridge/intel/common/firmware/Kconfig b/src/southbridge/intel/common/firmware/Kconfig index 45d8be8..2549c10 100644 --- a/src/southbridge/intel/common/firmware/Kconfig +++ b/src/southbridge/intel/common/firmware/Kconfig @@ -64,6 +64,32 @@ proceeding with the build, in order to prevent an accidental loading of a corrupted ME/TXE image. +config ME_SBOM + bool "Include SBOM file" + depends on HAVE_ME_BIN + default y + help + Select this option if you want to include a coswid (Concise Software Identification Tag) + of the ME (Management Engine) into the SBOM (Software Bill of Materials) File in your build + +config ME_SBOM_GENERATE + bool "Generate SBOM file" + depends on ME_SBOM + default y + help + Select this option if you want coreboot to generate and include + the coswid (Concise Software Identification Tag) instead of supplying it manually. + Be aware that this option is only meant to be a transition and suppliers of Software + should always prefer to include their own Software descriptions, since ours may be + incomplete or straight up wrong. + +config ME_SBOM_PATH + string "SBOM file path" + depends on ME_SBOM && !ME_SBOM_GENERATE + help + The path of the SBOM file (sbom.ini file) + The path of the .ini file describing the Software included in the build + config ME_REGION_ALLOW_CPU_READ_ACCESS bool "Allows HOST/CPU read access to ME region" depends on HAVE_IFD_BIN -- To view, visit https://review.coreboot.org/c/coreboot/+/63639 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Icb7481d4903f95d200eddbfed7728fbec51819d0 Gerrit-Change-Number: 63639 Gerrit-PatchSet: 1 Gerrit-Owner: Maximilian Brune <maximilian.brune(a)9elements.com> Gerrit-MessageType: newchange

1 0

Change in coreboot[master]: ec/google/chromeec: add fan speed rpm control
by Sumeet R Pawnikar (Code Review) 14 Apr '22

14 Apr '22

Attention is currently required from: Paul Menzel, Tim Wawrzynczak, Eric Lai. Sumeet R Pawnikar has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/62789 ) Change subject: ec/google/chromeec: add fan speed rpm control ...................................................................... Patch Set 3: (2 comments) Commit Message: https://review.coreboot.org/c/coreboot/+/62789/comment/22cfd2f7_78d061d9 PS2, Line 10: > Where is CFSP documented? Added doc number under commit message. https://review.coreboot.org/c/coreboot/+/62789/comment/a640e95b_0a33318d PS2, Line 13: TEST=Built and booted on ADL-P based Brya system > And then? How to verified the fan speed? Verified the fan speed by checking the sysfs value. -- To view, visit https://review.coreboot.org/c/coreboot/+/62789 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Ibb1646b1fb1659fd853ece97d97bb9dee2a3f57e Gerrit-Change-Number: 62789 Gerrit-PatchSet: 3 Gerrit-Owner: Sumeet R Pawnikar <sumeet.r.pawnikar(a)intel.com> Gerrit-Reviewer: Eric Lai <eric_lai(a)quanta.corp-partner.google.com> Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Attention: Eric Lai <eric_lai(a)quanta.corp-partner.google.com> Gerrit-Comment-Date: Thu, 14 Apr 2022 13:00:57 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-MessageType: comment

1 0

Change in coreboot[master]: ec/google/chromeec: add fan speed rpm control
by Sumeet R Pawnikar (Code Review) 14 Apr '22

14 Apr '22

Attention is currently required from: Tim Wawrzynczak, Sumeet R Pawnikar, Eric Lai. Hello build bot (Jenkins), Tim Wawrzynczak, Eric Lai, I'd like you to reexamine a change. Please visit https://review.coreboot.org/c/coreboot/+/62789 to look at the new patch set (#3). Change subject: ec/google/chromeec: add fan speed rpm control ...................................................................... ec/google/chromeec: add fan speed rpm control Add fan speed rpm control for DPTF based Active2 policy as per document #626708. BUG=b:224457192 BRANCH=None TEST=Built and booted on ADL-P based Brya system and verify the fan_speed under sysfs. Change-Id: Ibb1646b1fb1659fd853ece97d97bb9dee2a3f57e Signed-off-by: Sumeet Pawnikar <sumeet.r.pawnikar(a)intel.com> --- M src/ec/google/chromeec/acpi/ec.asl M src/ec/google/chromeec/ec_dptf_helpers.c 2 files changed, 7 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/89/62789/3 -- To view, visit https://review.coreboot.org/c/coreboot/+/62789 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Ibb1646b1fb1659fd853ece97d97bb9dee2a3f57e Gerrit-Change-Number: 62789 Gerrit-PatchSet: 3 Gerrit-Owner: Sumeet R Pawnikar <sumeet.r.pawnikar(a)intel.com> Gerrit-Reviewer: Eric Lai <eric_lai(a)quanta.corp-partner.google.com> Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Attention: Sumeet R Pawnikar <sumeet.r.pawnikar(a)intel.com> Gerrit-Attention: Eric Lai <eric_lai(a)quanta.corp-partner.google.com> Gerrit-MessageType: newpatchset

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

coreboot-gerrit April 2022