Attention is currently required from: Bora Guvendik, Wonkyu Kim, Selma Bensaid, Jérémy Compostella, Nicholas Chin.
Nico Huber has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/67118 )
Change subject: libpayload/Makefile.inc: Initialize vboot depending on UPDATED_SUBMODULES
......................................................................
Patch Set 3:
(2 comments)
Patchset:
PS3:
> @Nicholas, thanks for all the details. […]
UPDATED_SUBMODULES is not meant to be used as a user interface. I assume
this change would only work if the payload's Makefile isn't updated yet to
unexport COREBOOT_EXPORTS. So things would be very fragile and might break
again soon.
To avoid a checkout of the wrong commit in a submodule, you can always add
the change to the index. Would that solve your problem?
File payloads/libpayload/Makefile.inc:
https://review.coreboot.org/c/coreboot/+/67118/comment/f130a2c6_a3d6121f
PS2, Line 91: ifneq ($(UPDATED_SUBMODULES),1)
> Apparently one purpose of UPDATED_SUBMODULES in coreboot's top level Makefile.inc is to avoid calling the git command again if make is called recursively.
AIUI, that is its only purpose. And repurposing it makes things complicated.
> That said, even if I set the variable, similar to the top level Makefile.inc, it still seems to run the update twice when building manually, so I guess something else is the source of that issue.
This seems odd, did you also export the variable?
--
To view, visit https://review.coreboot.org/c/coreboot/+/67118
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I4d58b863cf709930900c7e691e52cac71f88a349
Gerrit-Change-Number: 67118
Gerrit-PatchSet: 3
Gerrit-Owner: Selma Bensaid <selma.bensaid(a)intel.com>
Gerrit-Reviewer: Bora Guvendik <bora.guvendik(a)intel.com>
Gerrit-Reviewer: Jérémy Compostella <jeremy.compostella(a)intel.com>
Gerrit-Reviewer: Nicholas Chin <nic.c3.14(a)gmail.com>
Gerrit-Reviewer: Nico Huber <nico.h(a)gmx.de>
Gerrit-Reviewer: Wonkyu Kim <wonkyu.kim(a)intel.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Attention: Bora Guvendik <bora.guvendik(a)intel.com>
Gerrit-Attention: Wonkyu Kim <wonkyu.kim(a)intel.com>
Gerrit-Attention: Selma Bensaid <selma.bensaid(a)intel.com>
Gerrit-Attention: Jérémy Compostella <jeremy.compostella(a)intel.com>
Gerrit-Attention: Nicholas Chin <nic.c3.14(a)gmail.com>
Gerrit-Comment-Date: Sat, 03 Sep 2022 11:56:41 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Selma Bensaid <selma.bensaid(a)intel.com>
Comment-In-Reply-To: Nicholas Chin <nic.c3.14(a)gmail.com>
Gerrit-MessageType: comment
Attention is currently required from: Martin L Roth, Angel Pons, Felix Held.
Felix Singer has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/64973 )
Change subject: util/lint: Update tools that use git to use a library
......................................................................
Patch Set 4: Code-Review+1
--
To view, visit https://review.coreboot.org/c/coreboot/+/64973
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I61ba1cc4f7205e0d4baf993588bbc774120405cb
Gerrit-Change-Number: 64973
Gerrit-PatchSet: 4
Gerrit-Owner: Martin L Roth <gaumless(a)gmail.com>
Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-Reviewer: Elyes Haouas <ehaouas(a)noos.fr>
Gerrit-Reviewer: Felix Held <felix-coreboot(a)felixheld.de>
Gerrit-Reviewer: Felix Singer <felixsinger(a)posteo.net>
Gerrit-Reviewer: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Attention: Martin L Roth <gaumless(a)gmail.com>
Gerrit-Attention: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-Attention: Felix Held <felix-coreboot(a)felixheld.de>
Gerrit-Comment-Date: Sat, 03 Sep 2022 02:53:21 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
Gerrit-MessageType: comment
Attention is currently required from: Martin L Roth.
Felix Singer has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/66922 )
Change subject: util/crossgcc: Update GCC from 11.2 to 12.2
......................................................................
Patch Set 7:
(1 comment)
Patchset:
PS4:
> No, the coreboot gerrit builder always uses the same toolchain and does not rely on the toolchain bu […]
Ah, thanks for clarifying
--
To view, visit https://review.coreboot.org/c/coreboot/+/66922
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ia15e48847c6aea4f3188588b5092250568f16a09
Gerrit-Change-Number: 66922
Gerrit-PatchSet: 7
Gerrit-Owner: Felix Singer <felixsinger(a)posteo.net>
Gerrit-Reviewer: Martin L Roth <gaumless(a)gmail.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Attention: Martin L Roth <gaumless(a)gmail.com>
Gerrit-Comment-Date: Sat, 03 Sep 2022 02:44:20 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Felix Singer <felixsinger(a)posteo.net>
Comment-In-Reply-To: Martin L Roth <gaumless(a)gmail.com>
Gerrit-MessageType: comment
Julius Werner has submitted this change. ( https://review.coreboot.org/c/coreboot/+/66346 )
(
1 is the latest approved patch-set.
No files were changed between the latest approved patch-set and the submitted one.
)Change subject: soc/intel: Add SI_DESC region to GSCVD ranges
......................................................................
soc/intel: Add SI_DESC region to GSCVD ranges
Intel platforms have soft straps stored in the SI_DESC FMAP section
which can alter boot behavior and may open up a security risk if they
can be modified by an attacker. This patch adds the SI_DESC region to
the list of ranges covered by GSC verification (CONFIG_VBOOT_GSCVD).
Signed-off-by: Julius Werner <jwerner(a)chromium.org>
Change-Id: I0f1b297e207d3c6152bf99ec5a5b0983f01b2d0b
Reviewed-on: https://review.coreboot.org/c/coreboot/+/66346
Reviewed-by: Yu-Ping Wu <yupingso(a)google.com>
Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org>
---
M src/security/vboot/Makefile.inc
M src/soc/intel/common/Makefile.inc
2 files changed, 29 insertions(+), 0 deletions(-)
Approvals:
build bot (Jenkins): Verified
Yu-Ping Wu: Looks good to me, approved
diff --git a/src/security/vboot/Makefile.inc b/src/security/vboot/Makefile.inc
index faa79cb..d38fbac 100644
--- a/src/security/vboot/Makefile.inc
+++ b/src/security/vboot/Makefile.inc
@@ -292,6 +292,8 @@
fmap-section-offset-cmd = $(FUTILITY) dump_fmap -p $(obj)/coreboot.rom | \
grep '^$(1) ' | cut '-d ' -f2
+fmap-section-size-cmd = $(FUTILITY) dump_fmap -p $(obj)/coreboot.rom | \
+ grep '^$(1) ' | cut '-d ' -f3
ifeq ($(CONFIG_VBOOT_GSCVD),y)
#
diff --git a/src/soc/intel/common/Makefile.inc b/src/soc/intel/common/Makefile.inc
index 43fc2f8..28842da 100644
--- a/src/soc/intel/common/Makefile.inc
+++ b/src/soc/intel/common/Makefile.inc
@@ -68,4 +68,13 @@
endif
+# SI_DESC contains soft straps that may modify security-relevant behavior, so it should be
+# verified by GSCVD.
+vboot-gscvd-ranges += $(shell ( \
+ offset=$$($(call fmap-section-offset-cmd,SI_DESC)) ;\
+ if [ -n "$$offset" ]; then \
+ printf "%x:%x" $$offset $$($(call fmap-section-size-cmd,SI_DESC)) ;\
+ fi ;\
+))
+
endif
--
To view, visit https://review.coreboot.org/c/coreboot/+/66346
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I0f1b297e207d3c6152bf99ec5a5b0983f01b2d0b
Gerrit-Change-Number: 66346
Gerrit-PatchSet: 3
Gerrit-Owner: Julius Werner <jwerner(a)chromium.org>
Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org>
Gerrit-Reviewer: Yu-Ping Wu <yupingso(a)google.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-MessageType: merged