coreboot-gerrit November 2023

coreboot-gerrit@coreboot.org

1 participants
3037 discussions

[S] Change in coreboot[main]: mb/google/brox: Fix GPIO assignments in gpio.h
by Nick Vaccaro (Code Review) 17 Nov '23

17 Nov '23

Attention is currently required from: Karthik Ramasubramanian, Shelley Chen. Nick Vaccaro has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/78952?usp=email ) Change subject: mb/google/brox: Fix GPIO assignments in gpio.h ...................................................................... Patch Set 3: Code-Review+2 -- To view, visit https://review.coreboot.org/c/coreboot/+/78952?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I6320cd98e560e514e63c52e173cb7923cfd1cdee Gerrit-Change-Number: 78952 Gerrit-PatchSet: 3 Gerrit-Owner: Shelley Chen <shchen(a)google.com> Gerrit-Reviewer: Karthik Ramasubramanian <kramasub(a)google.com> Gerrit-Reviewer: Nick Vaccaro <nvaccaro(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Shelley Chen <shchen(a)google.com> Gerrit-Attention: Karthik Ramasubramanian <kramasub(a)google.com> Gerrit-Comment-Date: Fri, 17 Nov 2023 19:31:57 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

[XS] Change in coreboot[main]: mb/goog/brya: Add gpio configuration based on FW_CONFIG
by Nick Vaccaro (Code Review) 17 Nov '23

17 Nov '23

Nick Vaccaro has abandoned this change. ( https://review.coreboot.org/c/coreboot/+/79119?usp=email ) Change subject: mb/goog/brya: Add gpio configuration based on FW_CONFIG ...................................................................... Abandoned -- To view, visit https://review.coreboot.org/c/coreboot/+/79119?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: Ica92ce397e1ea2769b1a698d77ccd51dc87605c8 Gerrit-Change-Number: 79119 Gerrit-PatchSet: 2 Gerrit-Owner: Nick Vaccaro <nvaccaro(a)google.com> Gerrit-Reviewer: Eric Lai <ericllai(a)google.com> Gerrit-Reviewer: Nick Vaccaro <nvaccaro(a)chromium.org> Gerrit-Reviewer: Nick Vaccaro <nvaccaro(a)google.com> Gerrit-Reviewer: Shelley Chen <shchen(a)google.com> Gerrit-Reviewer: Subrata Banik <subratabanik(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-MessageType: abandon

1 0

[M] Change in coreboot[main]: mb/goog/brya/var/brya0/skolas: Disable LTE gpios if LTE_ABSENT
by Nick Vaccaro (Code Review) 17 Nov '23

17 Nov '23

Nick Vaccaro has abandoned this change. ( https://review.coreboot.org/c/coreboot/+/79120?usp=email ) Change subject: mb/goog/brya/var/brya0/skolas: Disable LTE gpios if LTE_ABSENT ...................................................................... Abandoned -- To view, visit https://review.coreboot.org/c/coreboot/+/79120?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: Ie2143f110c6bd97ae4ebbac7489ab8f043738eab Gerrit-Change-Number: 79120 Gerrit-PatchSet: 2 Gerrit-Owner: Nick Vaccaro <nvaccaro(a)google.com> Gerrit-Reviewer: Eric Lai <ericllai(a)google.com> Gerrit-Reviewer: Nick Vaccaro <nvaccaro(a)chromium.org> Gerrit-Reviewer: Nick Vaccaro <nvaccaro(a)google.com> Gerrit-Reviewer: Shelley Chen <shchen(a)google.com> Gerrit-Reviewer: Subrata Banik <subratabanik(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-MessageType: abandon

1 0

[M] Change in coreboot[main]: mb/goog/brya/var/brya0/skolas: Disable LTE GPIOs if LTE_ABSENT
by Nick Vaccaro (Code Review) 17 Nov '23

17 Nov '23

Attention is currently required from: Eric Lai, Nick Vaccaro, Subrata Banik. Nick Vaccaro has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/79122?usp=email ) Change subject: mb/goog/brya/var/brya0/skolas: Disable LTE GPIOs if LTE_ABSENT ...................................................................... mb/goog/brya/var/brya0/skolas: Disable LTE GPIOs if LTE_ABSENT Check FW_CONFIG and disable gpios for LTE if LTE_ABSENT for skolas and brya0 variants. BUG=b:311459627 BRANCH=firmware-brya-14505.B TEST=`emerge-brya coreboot chromeos-bootimage`, flash and boot aviko to kernel. Change-Id: I3f3bc2b536babf71cc484cce02f96f47707f729c Signed-off-by: Nick Vaccaro <nvaccaro(a)google.com> --- M src/mainboard/google/brya/variants/brya0/fw_config.c M src/mainboard/google/brya/variants/skolas/fw_config.c 2 files changed, 57 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/22/79122/1 diff --git a/src/mainboard/google/brya/variants/brya0/fw_config.c b/src/mainboard/google/brya/variants/brya0/fw_config.c index 9ff3481..cf071a3 100644 --- a/src/mainboard/google/brya/variants/brya0/fw_config.c +++ b/src/mainboard/google/brya/variants/brya0/fw_config.c @@ -100,6 +100,29 @@ PAD_NC(GPP_VGPIO_37, NONE), }; +static const struct pad_config lte_disable_pads[] = { + /* A7 : WWAN_PCIE_WAKE_ODL */ + PAD_NC(GPP_A7, NONE), + /* A8 : WWAN_RF_DISABLE_ODL */ + PAD_NC(GPP_A8, NONE), + /* D5 : SRCCLKREQ0# ==> WWAN_DPR_SAR_ODL */ + PAD_NC(GPP_D5, NONE), + /* E0 : SATAXPCIE0 ==> WWAN_PERST_L */ + PAD_NC(GPP_E0, NONE), + /* E10 : THC0_SPI1_CS# ==> WWAN_CONFIG0 */ + PAD_NC_LOCK(GPP_E10, NONE, LOCK_CONFIG), + /* E16 : WWAN_RST_L */ + PAD_NC(GPP_E16, NONE), + /* E17 : THC0_SPI1_INT# ==> WWAN_CONFIG3 */ + PAD_NC_LOCK(GPP_E17, NONE, LOCK_CONFIG), + /* F21 : EXT_PWR_GATE2# ==> WWAN_FCPO_L */ + PAD_NC(GPP_F21, NONE), + /* H23 : SRCCLKREQ5# ==> WWAN_CLKREQ_ODL */ + PAD_NC(GPP_H23, NONE), + /* GPD11 : LANPHYC ==> WWAN_CONFIG1 */ + PAD_NC(GPD11, NONE), +}; + static void enable_i2s(void) { gpio_configure_pads(dmic_enable_pads, ARRAY_SIZE(dmic_enable_pads)); @@ -155,5 +178,10 @@ if (fw_config_probe(FW_CONFIG(AUDIO, NAU8318_NAU88L25B_I2S))) gpio_configure_pads(nau8318_enable_pads, ARRAY_SIZE(nau8318_enable_pads)); } + + if (fw_config_probe(FW_CONFIG(DB_LTE, LTE_ABSENT))) { + printk(BIOS_INFO, "Disable LTE GPIO pins.\n"); + gpio_configure_pads(lte_disable_pads, ARRAY_SIZE(lte_disable_pads)); + } } BOOT_STATE_INIT_ENTRY(BS_DEV_ENABLE, BS_ON_ENTRY, fw_config_handle, NULL); diff --git a/src/mainboard/google/brya/variants/skolas/fw_config.c b/src/mainboard/google/brya/variants/skolas/fw_config.c index 9ff3481..83f1d50 100644 --- a/src/mainboard/google/brya/variants/skolas/fw_config.c +++ b/src/mainboard/google/brya/variants/skolas/fw_config.c @@ -100,6 +100,29 @@ PAD_NC(GPP_VGPIO_37, NONE), }; +static const struct pad_config lte_disable_pads[] = { + /* A7 : WWAN_PCIE_WAKE_ODL */ + PAD_NC(GPP_A7, NONE), + /* A8 : WWAN_RF_DISABLE_ODL */ + PAD_NC(GPP_A8, NONE), + /* D5 : SRCCLKREQ0# ==> WWAN_DPR_SAR_ODL */ + PAD_NC(GPP_D5, NONE), + /* E0 : SATAXPCIE0 ==> WWAN_PERST_L */ + PAD_NC(GPP_E0, NONE), + /* E10 : THC0_SPI1_CS# ==> WWAN_CONFIG0 */ + PAD_NC_LOCK(GPP_E10, NONE, LOCK_CONFIG), + /* E16 : WWAN_RST_L */ + PAD_NC(GPP_E16, NONE), + /* E17 : THC0_SPI1_INT# ==> WWAN_CONFIG3 */ + PAD_NC_LOCK(GPP_E17, NONE, LOCK_CONFIG), + /* F21 : EXT_PWR_GATE2# ==> WWAN_FCPO_L */ + PAD_NC(GPP_F21, NONE), + /* H23 : SRCCLKREQ5# ==> WWAN_CLKREQ_ODL */ + PAD_NC(GPP_H23, NONE), + /* GPD11 : LANPHYC ==> WWAN_CONFIG1 */ + PAD_NC(GPD11, NONE), +}; + static void enable_i2s(void) { gpio_configure_pads(dmic_enable_pads, ARRAY_SIZE(dmic_enable_pads)); @@ -155,5 +178,11 @@ if (fw_config_probe(FW_CONFIG(AUDIO, NAU8318_NAU88L25B_I2S))) gpio_configure_pads(nau8318_enable_pads, ARRAY_SIZE(nau8318_enable_pads)); } + + if (fw_config_probe(FW_CONFIG(DB_LTE, LTE_ABSENT))) { + printk(BIOS_INFO, "Disable LTE related GPIO pins.\n"); + gpio_configure_pads(lte_disable_pads, ARRAY_SIZE(lte_disable_pads)); + } + } BOOT_STATE_INIT_ENTRY(BS_DEV_ENABLE, BS_ON_ENTRY, fw_config_handle, NULL); -- To view, visit https://review.coreboot.org/c/coreboot/+/79122?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I3f3bc2b536babf71cc484cce02f96f47707f729c Gerrit-Change-Number: 79122 Gerrit-PatchSet: 1 Gerrit-Owner: Nick Vaccaro <nvaccaro(a)google.com> Gerrit-Reviewer: Eric Lai <ericllai(a)google.com> Gerrit-Reviewer: Nick Vaccaro <nvaccaro(a)chromium.org> Gerrit-Reviewer: Subrata Banik <subratabanik(a)google.com> Gerrit-Attention: Eric Lai <ericllai(a)google.com> Gerrit-Attention: Subrata Banik <subratabanik(a)google.com> Gerrit-Attention: Nick Vaccaro <nvaccaro(a)chromium.org> Gerrit-MessageType: newchange

1 0

[M] Change in coreboot[main]: mb/goog/brya/var/skolas: sync slolas overridetree with brya0
by Nick Vaccaro (Code Review) 17 Nov '23

17 Nov '23

Nick Vaccaro has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/79121?usp=email ) Change subject: mb/goog/brya/var/skolas: sync slolas overridetree with brya0 ...................................................................... mb/goog/brya/var/skolas: sync slolas overridetree with brya0 Skolas uses brya0 schematic, so override tree should be almost the same for brya0 and skolas. This change sync's the skolas overridetree.cb with brya0's overridetree.cb. BUG=b:311722825 BRANCH=firmware-brya-14505.B TEST=`emerge-brya coreboot chromeos-bootimage`, flash and boot skolas to kernel. Change-Id: I14a2ed803a8ffb8614018af587c66034fb724b38 Signed-off-by: Nick Vaccaro <nvaccaro(a)google.com> --- M src/mainboard/google/brya/variants/skolas/overridetree.cb 1 file changed, 81 insertions(+), 6 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/21/79121/1 diff --git a/src/mainboard/google/brya/variants/skolas/overridetree.cb b/src/mainboard/google/brya/variants/skolas/overridetree.cb index 388ea4f..bb6d1ea 100644 --- a/src/mainboard/google/brya/variants/skolas/overridetree.cb +++ b/src/mainboard/google/brya/variants/skolas/overridetree.cb @@ -132,7 +132,7 @@ # TCP1 (DP-2) for port C1 register "device[3].name" = ""DD03"" register "device[3].use_pld" = "true" - register "device[3].pld" = "ACPI_PLD_TYPE_C(RIGHT, LEFT, ACPI_PLD_GROUP(2, 1))" + register "device[3].pld" = "ACPI_PLD_TYPE_C(RIGHT, LEFT, ACPI_PLD_GROUP(2, 1))" # TCP2 (DP-3) for port C2 register "device[4].name" = ""DD04"" register "device[4].use_pld" = "true" @@ -548,7 +548,9 @@ register "link_freq[1]" = "180 * MHz" # 180 MHz register "remote_name" = ""IPU0"" + register "max_dstate_for_probe" = "ACPI_DEVICE_SLEEP_D3_COLD" register "has_power_resource" = "1" + #Controls register "clk_panel.clks[0].clknum" = "IMGCLKOUT_3" register "clk_panel.clks[0].freq" = "FREQ_19_2_MHZ" @@ -582,9 +584,23 @@ register "chip_name" = ""DW9768 VCM"" register "device_type" = "INTEL_ACPI_CAMERA_VCM" - register "pr0" = ""\\_SB.PCI0.I2C0.CAM0.PRIC"" register "vcm_compat" = ""dongwoon,dw9768"" + register "max_dstate_for_probe" = "ACPI_DEVICE_SLEEP_D0" + + register "has_power_resource" = "1" + + #Controls + register "gpio_panel.gpio[0].gpio_num" = "GPP_D16" #EN_WCAM_PWR + + #_ON + register "on_seq.ops_cnt" = "1" + register "on_seq.ops[0]" = "SEQ_OPS_GPIO_ENABLE(0, 0)" + + #_OFF + register "off_seq.ops_cnt" = "1" + register "off_seq.ops[0]" = "SEQ_OPS_GPIO_DISABLE(0, 0)" + device i2c 0C on probe WFC WFC_MIPI_OVTI8856 end @@ -595,7 +611,6 @@ register "chip_name" = ""AT24 EEPROM"" register "device_type" = "INTEL_ACPI_CAMERA_NVM" - register "pr0" = ""\\_SB.PCI0.I2C0.CAM0.PRIC"" register "nvm_compat" = ""atmel,24c1024"" register "nvm_size" = "0x2800" @@ -603,6 +618,21 @@ register "nvm_readonly" = "0x01" register "nvm_width" = "0x10" + register "max_dstate_for_probe" = "ACPI_DEVICE_SLEEP_D0" + + register "has_power_resource" = "1" + + #Controls + register "gpio_panel.gpio[0].gpio_num" = "GPP_D16" #EN_WCAM_PWR + + #_ON + register "on_seq.ops_cnt" = "1" + register "on_seq.ops[0]" = "SEQ_OPS_GPIO_ENABLE(0, 0)" + + #_OFF + register "off_seq.ops_cnt" = "1" + register "off_seq.ops[0]" = "SEQ_OPS_GPIO_DISABLE(0, 0)" + device i2c 58 on probe WFC WFC_MIPI_OVTI8856 end @@ -623,6 +653,8 @@ register "link_freq[1]" = "180 * MHz" # 180 MHz register "remote_name" = ""IPU0"" + register "max_dstate_for_probe" = "ACPI_DEVICE_SLEEP_D3_COLD" + register "has_power_resource" = "1" #Controls register "clk_panel.clks[0].clknum" = "IMGCLKOUT_3" @@ -657,9 +689,23 @@ register "chip_name" = ""DW AF DAC"" register "device_type" = "INTEL_ACPI_CAMERA_VCM" - register "pr0" = ""\\_SB.PCI0.I2C0.CAM0.PRIC"" register "vcm_compat" = ""dongwoon,dw9714"" + register "max_dstate_for_probe" = "ACPI_DEVICE_SLEEP_D0" + + register "has_power_resource" = "1" + + #Controls + register "gpio_panel.gpio[0].gpio_num" = "GPP_D16" #EN_WCAM_PWR + + #_ON + register "on_seq.ops_cnt" = "1" + register "on_seq.ops[0]" = "SEQ_OPS_GPIO_ENABLE(0, 0)" + + #_OFF + register "off_seq.ops_cnt" = "1" + register "off_seq.ops[0]" = "SEQ_OPS_GPIO_DISABLE(0, 0)" + device i2c 0C on probe WFC WFC_MIPI_KBAE350 end @@ -670,7 +716,6 @@ register "chip_name" = ""GT24C08"" register "device_type" = "INTEL_ACPI_CAMERA_NVM" - register "pr0" = ""\\_SB.PCI0.I2C0.CAM0.PRIC"" register "nvm_compat" = ""atmel,24c08"" register "nvm_size" = "0x2000" @@ -678,6 +723,21 @@ register "nvm_readonly" = "0x01" register "nvm_width" = "0x10" + register "max_dstate_for_probe" = "ACPI_DEVICE_SLEEP_D0" + + register "has_power_resource" = "1" + + #Controls + register "gpio_panel.gpio[0].gpio_num" = "GPP_D16" #EN_WCAM_PWR + + #_ON + register "on_seq.ops_cnt" = "1" + register "on_seq.ops[0]" = "SEQ_OPS_GPIO_ENABLE(0, 0)" + + #_OFF + register "off_seq.ops_cnt" = "1" + register "off_seq.ops[0]" = "SEQ_OPS_GPIO_DISABLE(0, 0)" + device i2c 50 on probe WFC WFC_MIPI_KBAE350 end @@ -800,6 +860,7 @@ register "link_freq[0]" = "384 * MHz" # 384 MHz register "link_freq[1]" = "96 * MHz" # 96 MHz register "remote_name" = ""IPU0"" + register "max_dstate_for_probe" = "ACPI_DEVICE_SLEEP_D3_COLD" register "has_power_resource" = "1" #Controls @@ -834,7 +895,6 @@ register "chip_name" = ""GT24C16S"" register "device_type" = "INTEL_ACPI_CAMERA_NVM" - register "pr0" = ""\\_SB.PCI0.I2C2.CAM1.PRIC"" register "nvm_compat" = ""atmel,24c1024"" register "nvm_size" = "0x800" @@ -842,6 +902,21 @@ register "nvm_readonly" = "0x01" register "nvm_width" = "0x08" + register "max_dstate_for_probe" = "ACPI_DEVICE_SLEEP_D0" + + register "has_power_resource" = "1" + + #Controls + register "gpio_panel.gpio[0].gpio_num" = "GPP_C3" #PP3300_FCAM_X + + #_ON + register "on_seq.ops_cnt" = "1" + register "on_seq.ops[0]" = "SEQ_OPS_GPIO_ENABLE(0, 0)" + + #_OFF + register "off_seq.ops_cnt" = "1" + register "off_seq.ops[0]" = "SEQ_OPS_GPIO_DISABLE(0, 0)" + device i2c 50 on probe UFC UFC_MIPI_IMX208 end -- To view, visit https://review.coreboot.org/c/coreboot/+/79121?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I14a2ed803a8ffb8614018af587c66034fb724b38 Gerrit-Change-Number: 79121 Gerrit-PatchSet: 1 Gerrit-Owner: Nick Vaccaro <nvaccaro(a)google.com> Gerrit-MessageType: newchange

1 0

[L] Change in coreboot[main]: Docs/releases: Update 4.22 release notes
by Matt DeVillier (Code Review) 17 Nov '23

17 Nov '23

Attention is currently required from: Angel Pons, Felix Singer, Jason Glenesk, Martin L Roth, Paul Menzel. Matt DeVillier has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/79077?usp=email ) Change subject: Docs/releases: Update 4.22 release notes ...................................................................... Patch Set 1: (2 comments) File Documentation/releases/coreboot-4.22-relnotes.md: https://review.coreboot.org/c/coreboot/+/79077/comment/2d5c7424_ac9bdad1 : PS1, Line 25: through up until https://review.coreboot.org/c/coreboot/+/79077/comment/17fe268c_66270f07 : PS1, Line 25: when at which time -- To view, visit https://review.coreboot.org/c/coreboot/+/79077?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: Id723f8e1fc92ef1a36e877f48e594eef59b0ba8e Gerrit-Change-Number: 79077 Gerrit-PatchSet: 1 Gerrit-Owner: Martin L Roth <gaumless(a)gmail.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Felix Singer <service+coreboot-gerrit(a)felixsinger.de> Gerrit-Reviewer: Jason Glenesk <jason.glenesk(a)gmail.com> Gerrit-Reviewer: Patrick Georgi <patrick(a)coreboot.org> Gerrit-Reviewer: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Matt DeVillier <matt.devillier(a)gmail.com> Gerrit-Attention: Felix Singer <service+coreboot-gerrit(a)felixsinger.de> Gerrit-Attention: Jason Glenesk <jason.glenesk(a)gmail.com> Gerrit-Attention: Martin L Roth <gaumless(a)gmail.com> Gerrit-Attention: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Comment-Date: Fri, 17 Nov 2023 19:19:46 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Gerrit-MessageType: comment

1 0

[M] Change in coreboot[main]: Documentation: Describe how SMMSTORE can be used safely
by Benjamin Doron (Code Review) 17 Nov '23

17 Nov '23

Attention is currently required from: Patrick Georgi. Benjamin Doron has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/79095?usp=email ) Change subject: Documentation: Describe how SMMSTORE can be used safely ...................................................................... Patch Set 2: Code-Review+1 (5 comments) Patchset: PS2: Looks pretty good to me. From "the boot process ... needs to be trusted," it generally seems like the intention is to use the root of trust for security, rather than isolation inside SMRAM. It's certainly not a bad idea, I like it for vboot, which has a fixed set of keys. (Whether we can make that work for secure boot, I'm not sure. Physical attackers are often left out of the attack model, so overwriting native UEFI's variable store offline is ignored, I suppose. But just provisioning keys into a cleared variable store is not enough, because an attacker could *patch*, instead of clear, the variable store). File Documentation/drivers/smmstore.md: https://review.coreboot.org/c/coreboot/+/79095/comment/9d330d91_8a0faa93 : PS2, Line 145: - while doing so, process authentication data and reject invalid blocks; So, I think that UEFI's variable store is authenticated for writes, not reads. On initialisation, I can see UEFI code attempting to determine if secure boot is enabled by looking for the existence of a variable, but not validating it. I suppose self-validation is a tricky question: if something can write over this, it can also make sure it's valid (of course, the key will be different, that's where measurement helps a bit). Perhaps I missed something, UEFI's variable stack is complicated. Anyways, not an issue with this document. https://review.coreboot.org/c/coreboot/+/79095/comment/011d8668_b3398132 : PS2, Line 171: An attacker could mess with future calls into the APIs, but they : can already do so: Other common APIs for boot level variable are : implemented in RAM as well, so they can easily be defused. nit: variables? Also, are you thinking of coreboot CMOS or UEFI variables here? Or both, I suppose. UEFI's native implementation in SMM is secure against this, at least for writes. If only SMM can write to SPI flash, and verification && write happen together in SMRAM, then verification can't be bypassed (at least online. A physically present attacker can write to this region offline). Perhaps a mention that this point depends on addressing the next one would be helpful? https://review.coreboot.org/c/coreboot/+/79095/comment/441f3e77_35e02a81 : PS2, Line 174: An attacker could flush the store with the CLEAR command. This is a : potential problem if the "empty state" is somehow less secure than : a fully configured system. This is the case for secure boot. For a simple boolean (like BIOS lock), I have and would default to secure settings when variables can't be found (at least for production code), but secure boot can't enable itself without keys. We'd solve part of the problem by storing default keys in SPI flash to use when the store is empty, but that wouldn't stop an attacker from overwriting keys. Users are allowed to do this. There would be a change in the data measured into the TPM, though whether that's good enough security... I have no idea. Servers and business PCs may have attestation, but clients do not. Again, not a issue here. https://review.coreboot.org/c/coreboot/+/79095/comment/48f07427_a462cf6f : PS2, Line 177: As a remedy, CLEAR could be disabled after the initial repacking, : within the boot process, so that SMMSTORE becomes an append-only : store. In this case, the attacker could fill up the buffer, leading : to a DoS of the variable store until it's repacked. As described : earlier, once there's an attacker on the system, the variable store : lost its function until the attacker has been evicted, anyway. Raw WRITE has to be protected to, because writing 0xFF is equivalent to clearing. If someone were to do this, they might want to pass some range of memory that should be protected against writes. "Append-only" probably hints at that to future readers. -- To view, visit https://review.coreboot.org/c/coreboot/+/79095?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I48f44d3416d210e1e6b19d18cad787e380ffeebc Gerrit-Change-Number: 79095 Gerrit-PatchSet: 2 Gerrit-Owner: Patrick Georgi <patrick(a)coreboot.org> Gerrit-Reviewer: Benjamin Doron <benjamin.doron00(a)gmail.com> Gerrit-Reviewer: Nico Huber <nico.h(a)gmx.de> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Patrick Georgi <patrick(a)coreboot.org> Gerrit-Comment-Date: Fri, 17 Nov 2023 18:43:18 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

[M] Change in coreboot[main]: mb/goog/brya/var/brya0/skolas: Disable LTE gpios if LTE_ABSENT
by Nick Vaccaro (Code Review) 17 Nov '23

17 Nov '23

Attention is currently required from: Eric Lai, Nick Vaccaro, Shelley Chen, Subrata Banik. Nick Vaccaro has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/79120?usp=email ) Change subject: mb/goog/brya/var/brya0/skolas: Disable LTE gpios if LTE_ABSENT ...................................................................... Patch Set 2: Code-Review-1 (1 comment) Patchset: PS2: I will be moving this change to fw_config_handle() in fw_config.c -- To view, visit https://review.coreboot.org/c/coreboot/+/79120?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: Ie2143f110c6bd97ae4ebbac7489ab8f043738eab Gerrit-Change-Number: 79120 Gerrit-PatchSet: 2 Gerrit-Owner: Nick Vaccaro <nvaccaro(a)google.com> Gerrit-Reviewer: Eric Lai <ericllai(a)google.com> Gerrit-Reviewer: Nick Vaccaro <nvaccaro(a)chromium.org> Gerrit-Reviewer: Nick Vaccaro <nvaccaro(a)google.com> Gerrit-Reviewer: Shelley Chen <shchen(a)google.com> Gerrit-Reviewer: Subrata Banik <subratabanik(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Shelley Chen <shchen(a)google.com> Gerrit-Attention: Eric Lai <ericllai(a)google.com> Gerrit-Attention: Subrata Banik <subratabanik(a)google.com> Gerrit-Attention: Nick Vaccaro <nvaccaro(a)chromium.org> Gerrit-Comment-Date: Fri, 17 Nov 2023 18:10:04 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

[XS] Change in coreboot[main]: mb/goog/brya: Add gpio configuration based on FW_CONFIG
by Nick Vaccaro (Code Review) 17 Nov '23

17 Nov '23

Attention is currently required from: Eric Lai, Nick Vaccaro, Shelley Chen, Subrata Banik. Nick Vaccaro has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/79119?usp=email ) Change subject: mb/goog/brya: Add gpio configuration based on FW_CONFIG ...................................................................... Patch Set 2: Code-Review-1 (1 comment) Patchset: PS2: Looks like there's already a place to configure for FW_CONFIG in fw_config_handle() in fw_config.c, so this change is likely not needed. -- To view, visit https://review.coreboot.org/c/coreboot/+/79119?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: Ica92ce397e1ea2769b1a698d77ccd51dc87605c8 Gerrit-Change-Number: 79119 Gerrit-PatchSet: 2 Gerrit-Owner: Nick Vaccaro <nvaccaro(a)google.com> Gerrit-Reviewer: Eric Lai <ericllai(a)google.com> Gerrit-Reviewer: Nick Vaccaro <nvaccaro(a)chromium.org> Gerrit-Reviewer: Nick Vaccaro <nvaccaro(a)google.com> Gerrit-Reviewer: Shelley Chen <shchen(a)google.com> Gerrit-Reviewer: Subrata Banik <subratabanik(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Shelley Chen <shchen(a)google.com> Gerrit-Attention: Eric Lai <ericllai(a)google.com> Gerrit-Attention: Subrata Banik <subratabanik(a)google.com> Gerrit-Attention: Nick Vaccaro <nvaccaro(a)chromium.org> Gerrit-Comment-Date: Fri, 17 Nov 2023 18:09:29 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

[XS] Change in coreboot[main]: qualcomm/sc7180: Move QCSDI and increase romstage size
by Shelley Chen (Code Review) 17 Nov '23

17 Nov '23

Attention is currently required from: Felix Held, Julius Werner. Shelley Chen has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/79074?usp=email ) Change subject: qualcomm/sc7180: Move QCSDI and increase romstage size ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://review.coreboot.org/c/coreboot/+/79074?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: Iaf13e4001b3c763e3ec59009779931ec75603d5d Gerrit-Change-Number: 79074 Gerrit-PatchSet: 2 Gerrit-Owner: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: Felix Held <felix-coreboot(a)felixheld.de> Gerrit-Reviewer: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Reviewer: Shelley Chen <shchen(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Julius Werner <jwerner(a)chromium.org> Gerrit-Attention: Felix Held <felix-coreboot(a)felixheld.de> Gerrit-Comment-Date: Fri, 17 Nov 2023 17:49:58 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

coreboot-gerrit November 2023