coreboot-gerrit January 2024

coreboot-gerrit@coreboot.org

1 participants
3043 discussions

[XS] Change in coreboot[main]: mb/intel/mtlrvp: add 512KB SI_EC FMAP region
by Deepti Deshatty (Code Review) 03 Jan '24

03 Jan '24

Attention is currently required from: Balaji Manigandan, Deepti Deshatty, Kapil Porwal, Krishna P Bhat D, Paul Menzel, Subrata Banik. Hello Balaji Manigandan, Deepti Deshatty, Eric Lai, Kapil Porwal, Krishna P Bhat D, Subrata Banik, Vijay P Hiremath, build bot (Jenkins), I'd like you to reexamine a change. Please visit https://review.coreboot.org/c/coreboot/+/79209?usp=email to look at the new patch set (#10). Change subject: mb/intel/mtlrvp: add 512KB SI_EC FMAP region ...................................................................... mb/intel/mtlrvp: add 512KB SI_EC FMAP region This patch introduces the 512KB SI_EC FMAP region for storing the EC firmware, a necessary addition to support EC chips without internal flash memory. As a testing platform, the MTLRVP Chrome SKU is utilized in conjunction with the Microchip EC1723, and the changes are verified. Cq-Depend: chrome-internal:6691498 Cq-Depend: chrome-internal:6741356 BUG=b:289783489 TEST=build "emerge-rex coreboot chromeos-bootimage" is successful. changes are verified. EC Log: 23-11-06 17:46:49.564 --- UART initialized after reboot --- 23-11-06 17:46:49.564 [Image: RO, mtlrvpp_m1723_v3.5.142816-ec:6596a3, os:f660f7,cmsis:42cf18,picolibc:6669e4] 23-11-06 17:46:54.609 D: Power state: S5 --> S5S4 23-11-06 17:46:54.620 D: Power state: S5S4 --> S4 23-11-06 17:46:54.620 D: Power state: S4 --> S4S3 23-11-06 17:46:54.642 I: power state 10 = S3S0, in 0x0087 23-11-06 17:46:54.642 ec:~>: Power state: S3S0 --> S0 Change-Id: I788dbeaad05e5d6904fb2c7c681a0bf653dc7d84 Signed-off-by: Deepti Deshatty <deepti.deshatty(a)intel.corp-partner.google.com> --- M src/mainboard/intel/mtlrvp/chromeos.fmd 1 file changed, 1 insertion(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/09/79209/10 -- To view, visit https://review.coreboot.org/c/coreboot/+/79209?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I788dbeaad05e5d6904fb2c7c681a0bf653dc7d84 Gerrit-Change-Number: 79209 Gerrit-PatchSet: 10 Gerrit-Owner: Deepti Deshatty <deepti.deshatty(a)intel.com> Gerrit-Reviewer: Balaji Manigandan <balaji.manigandan(a)intel.com> Gerrit-Reviewer: Eric Lai <ericllai(a)google.com> Gerrit-Reviewer: Kapil Porwal <kapilporwal(a)google.com> Gerrit-Reviewer: Krishna P Bhat D <krishna.p.bhat.d(a)intel.com> Gerrit-Reviewer: Subrata Banik <subratabanik(a)google.com> Gerrit-Reviewer: Vijay P Hiremath <vijay.p.hiremath(a)intel.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Deepti Deshatty <deepti.deshatty(a)intel.corp-partner.google.com> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Subrata Banik <subratabanik(a)google.com> Gerrit-Attention: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Kapil Porwal <kapilporwal(a)google.com> Gerrit-Attention: Krishna P Bhat D <krishna.p.bhat.d(a)intel.com> Gerrit-Attention: Balaji Manigandan <balaji.manigandan(a)intel.com> Gerrit-Attention: Deepti Deshatty <deepti.deshatty(a)intel.com> Gerrit-MessageType: newpatchset

1 0

[S] Change in coreboot[main]: mb/intel/mtlrvp: define a new config for Chrome EC
by Deepti Deshatty (Code Review) 03 Jan '24

03 Jan '24

Attention is currently required from: Balaji Manigandan, Deepti Deshatty, Deepti Deshatty, Kapil Porwal, Krishna P Bhat D, Paul Menzel, Subrata Banik, Vijay P Hiremath. Hello Balaji Manigandan, Deepti Deshatty, Kapil Porwal, Krishna P Bhat D, Subrata Banik, Vijay P Hiremath, build bot (Jenkins), I'd like you to reexamine a change. Please visit https://review.coreboot.org/c/coreboot/+/79211?usp=email to look at the new patch set (#6). The following approvals got outdated and were removed: Code-Review+1 by Vijay P Hiremath, Verified+1 by build bot (Jenkins) Change subject: mb/intel/mtlrvp: define a new config for Chrome EC ...................................................................... mb/intel/mtlrvp: define a new config for Chrome EC Introduce new config MTL_CHROME_EC_SHARED_SPI, tailored for Chrome ECs utilizing an external shared SPI flash. BUG=b:289783489 TEST=emerge-rex coreboot chromeos-bootimage is successful Cq-Depend: chrome-internal:6691498 Cq-Depend: chrome-internal:6741356 Change-Id: I0b85cc48d5cefadb52edbb27bf6cf370b27c395f Signed-off-by: Deepti Deshatty <deepti.deshatty(a)intel.corp-partner.google.com> --- M src/mainboard/intel/mtlrvp/Kconfig 1 file changed, 16 insertions(+), 6 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/11/79211/6 -- To view, visit https://review.coreboot.org/c/coreboot/+/79211?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I0b85cc48d5cefadb52edbb27bf6cf370b27c395f Gerrit-Change-Number: 79211 Gerrit-PatchSet: 6 Gerrit-Owner: Deepti Deshatty <deepti.deshatty(a)intel.com> Gerrit-Reviewer: Balaji Manigandan <balaji.manigandan(a)intel.com> Gerrit-Reviewer: Deepti Deshatty <deepti.deshatty(a)intel.corp-partner.google.com> Gerrit-Reviewer: Kapil Porwal <kapilporwal(a)google.com> Gerrit-Reviewer: Krishna P Bhat D <krishna.p.bhat.d(a)intel.com> Gerrit-Reviewer: Subrata Banik <subratabanik(a)google.com> Gerrit-Reviewer: Vijay P Hiremath <vijay.p.hiremath(a)intel.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Eric Lai <ericllai(a)google.com> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Vijay P Hiremath <vijay.p.hiremath(a)intel.com> Gerrit-Attention: Subrata Banik <subratabanik(a)google.com> Gerrit-Attention: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Kapil Porwal <kapilporwal(a)google.com> Gerrit-Attention: Deepti Deshatty <deepti.deshatty(a)intel.corp-partner.google.com> Gerrit-Attention: Krishna P Bhat D <krishna.p.bhat.d(a)intel.com> Gerrit-Attention: Balaji Manigandan <balaji.manigandan(a)intel.com> Gerrit-Attention: Deepti Deshatty <deepti.deshatty(a)intel.com> Gerrit-MessageType: newpatchset

1 0

[S] Change in coreboot[main]: vendorcode/google/chromeos: Use unsigned int for "factory_config"
by Subrata Banik (Code Review) 03 Jan '24

03 Jan '24

Attention is currently required from: Eric Lai, Julius Werner, Kapil Porwal, Shelley Chen, Tim Van Patten. Subrata Banik has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/79769?usp=email ) Change subject: vendorcode/google/chromeos: Use unsigned int for "factory_config" ...................................................................... Patch Set 1: (1 comment) File src/vendorcode/google/chromeos/tpm_factory_config.c: https://review.coreboot.org/c/coreboot/+/79769/comment/ef9a69ed_5443893c : PS1, Line 27: rc = tlcl_cr50_get_factory_config(&factory_config); > This function should assert `factory_config != CHROMEOS_ERROR` after this call also, to catch any ch […] Acknowledged -- To view, visit https://review.coreboot.org/c/coreboot/+/79769?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I3021b8646de4750b4c8e2a2981f42500894fa2d0 Gerrit-Change-Number: 79769 Gerrit-PatchSet: 1 Gerrit-Owner: Subrata Banik <subratabanik(a)google.com> Gerrit-Reviewer: Eric Lai <ericllai(a)google.com> Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: Kapil Porwal <kapilporwal(a)google.com> Gerrit-Reviewer: Shelley Chen <shchen(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Tim Van Patten <timvp(a)google.com> Gerrit-Attention: Shelley Chen <shchen(a)google.com> Gerrit-Attention: Eric Lai <ericllai(a)google.com> Gerrit-Attention: Kapil Porwal <kapilporwal(a)google.com> Gerrit-Attention: Julius Werner <jwerner(a)chromium.org> Gerrit-Attention: Tim Van Patten <timvp(a)google.com> Gerrit-Comment-Date: Wed, 03 Jan 2024 06:51:56 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Tim Van Patten <timvp(a)google.com> Gerrit-MessageType: comment

1 0

[S] Change in coreboot[main]: vendorcode/google/chromeos: Use unsigned int for "factory_config"
by Subrata Banik (Code Review) 03 Jan '24

03 Jan '24

Attention is currently required from: Eric Lai, Julius Werner, Kapil Porwal, Shelley Chen, Subrata Banik. Hello Eric Lai, Julius Werner, Kapil Porwal, Shelley Chen, build bot (Jenkins), I'd like you to reexamine a change. Please visit https://review.coreboot.org/c/coreboot/+/79769?usp=email to look at the new patch set (#2). The following approvals got outdated and were removed: Verified+1 by build bot (Jenkins) Change subject: vendorcode/google/chromeos: Use unsigned int for "factory_config" ...................................................................... vendorcode/google/chromeos: Use unsigned int for "factory_config" This patch ensures `chromeos_get_factory_config()` returns an unsigned integer value because factory config represents bit-fields to determine the Chromebook Plus branding. Additionally, introduced safety measures to catch future "factory_config" bit-field exhaustion. BUG=b:317880956 TEST=Able to verify that google/screebo is branded as Chromebook Plus. Change-Id: I3021b8646de4750b4c8e2a2981f42500894fa2d0 Signed-off-by: Subrata Banik <subratabanik(a)google.com> --- M src/vendorcode/google/chromeos/chromeos.h M src/vendorcode/google/chromeos/tpm_factory_config.c 2 files changed, 15 insertions(+), 10 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/69/79769/2 -- To view, visit https://review.coreboot.org/c/coreboot/+/79769?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I3021b8646de4750b4c8e2a2981f42500894fa2d0 Gerrit-Change-Number: 79769 Gerrit-PatchSet: 2 Gerrit-Owner: Subrata Banik <subratabanik(a)google.com> Gerrit-Reviewer: Eric Lai <ericllai(a)google.com> Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: Kapil Porwal <kapilporwal(a)google.com> Gerrit-Reviewer: Shelley Chen <shchen(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Tim Van Patten <timvp(a)google.com> Gerrit-Attention: Shelley Chen <shchen(a)google.com> Gerrit-Attention: Eric Lai <ericllai(a)google.com> Gerrit-Attention: Subrata Banik <subratabanik(a)google.com> Gerrit-Attention: Kapil Porwal <kapilporwal(a)google.com> Gerrit-Attention: Julius Werner <jwerner(a)chromium.org> Gerrit-MessageType: newpatchset

1 0

[XS] Change in coreboot[main]: mb/intel/mtlrvp: add 512KB SI_EC FMAP region
by Deepti Deshatty (Code Review) 03 Jan '24

03 Jan '24

Attention is currently required from: Balaji Manigandan, Kapil Porwal, Krishna P Bhat D, Paul Menzel, Subrata Banik. Deepti Deshatty has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/79209?usp=email ) Change subject: mb/intel/mtlrvp: add 512KB SI_EC FMAP region ...................................................................... Patch Set 8: (1 comment) Commit Message: https://review.coreboot.org/c/coreboot/+/79209/comment/74939041_a866f0fb : PS7, Line 19: TEST=build "emerge-rex coreboot chromeos-bootimage" is successful > “and the changes are verified” sounds like you even runtime tested this. […] Done -- To view, visit https://review.coreboot.org/c/coreboot/+/79209?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I788dbeaad05e5d6904fb2c7c681a0bf653dc7d84 Gerrit-Change-Number: 79209 Gerrit-PatchSet: 8 Gerrit-Owner: Deepti Deshatty <deepti.deshatty(a)intel.com> Gerrit-Reviewer: Balaji Manigandan <balaji.manigandan(a)intel.com> Gerrit-Reviewer: Eric Lai <ericllai(a)google.com> Gerrit-Reviewer: Kapil Porwal <kapilporwal(a)google.com> Gerrit-Reviewer: Krishna P Bhat D <krishna.p.bhat.d(a)intel.com> Gerrit-Reviewer: Subrata Banik <subratabanik(a)google.com> Gerrit-Reviewer: Vijay P Hiremath <vijay.p.hiremath(a)intel.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Deepti Deshatty <deepti.deshatty(a)intel.corp-partner.google.com> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Subrata Banik <subratabanik(a)google.com> Gerrit-Attention: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Kapil Porwal <kapilporwal(a)google.com> Gerrit-Attention: Krishna P Bhat D <krishna.p.bhat.d(a)intel.com> Gerrit-Attention: Balaji Manigandan <balaji.manigandan(a)intel.com> Gerrit-Comment-Date: Wed, 03 Jan 2024 05:17:28 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-MessageType: comment

1 0

[XS] Change in coreboot[main]: mb/intel/mtlrvp: add 512KB SI_EC FMAP region
by Deepti Deshatty (Code Review) 03 Jan '24

03 Jan '24

Attention is currently required from: Balaji Manigandan, Deepti Deshatty, Kapil Porwal, Krishna P Bhat D, Subrata Banik. Hello Balaji Manigandan, Eric Lai, Kapil Porwal, Krishna P Bhat D, Subrata Banik, Vijay P Hiremath, build bot (Jenkins), I'd like you to reexamine a change. Please visit https://review.coreboot.org/c/coreboot/+/79209?usp=email to look at the new patch set (#8). Change subject: mb/intel/mtlrvp: add 512KB SI_EC FMAP region ...................................................................... mb/intel/mtlrvp: add 512KB SI_EC FMAP region This patch introduces the 512KB SI_EC FMAP region for storing the EC firmware, a necessary addition to support EC chips without internal flash memory. As a testing platform, the MTLRVP Chrome SKU is utilized in conjunction with the Microchip EC1723, and the changes are verified. Cq-Depend: chrome-internal:6691498 Cq-Depend: chrome-internal:6741356 BUG=b:289783489 TEST=build "emerge-rex coreboot chromeos-bootimage" is successful. changes are verified. EC Log: 23-11-06 17:46:49.564 --- UART initialized after reboot --- 23-11-06 17:46:49.564 [Image: RO, mtlrvpp_m1723_v3.5.142816-ec:6596a3,os:f660f7,cmsis:42cf18,picolibc:6669e4 2023-11-03 23:01:58 root@cssdesk-voxel] 23-11-06 17:46:54.609 D: Power state: S5 --> S5S4 23-11-06 17:46:54.620 D: Power state: S5S4 --> S4 23-11-06 17:46:54.620 D: Power state: S4 --> S4S3 23-11-06 17:46:54.642 I: power state 10 = S3S0, in 0x0087 23-11-06 17:46:54.642 ec:~>: Power state: S3S0 --> S0 Change-Id: I788dbeaad05e5d6904fb2c7c681a0bf653dc7d84 Signed-off-by: Deepti Deshatty <deepti.deshatty(a)intel.corp-partner.google.com> --- M src/mainboard/intel/mtlrvp/chromeos.fmd 1 file changed, 1 insertion(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/09/79209/8 -- To view, visit https://review.coreboot.org/c/coreboot/+/79209?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I788dbeaad05e5d6904fb2c7c681a0bf653dc7d84 Gerrit-Change-Number: 79209 Gerrit-PatchSet: 8 Gerrit-Owner: Deepti Deshatty <deepti.deshatty(a)intel.com> Gerrit-Reviewer: Balaji Manigandan <balaji.manigandan(a)intel.com> Gerrit-Reviewer: Eric Lai <ericllai(a)google.com> Gerrit-Reviewer: Kapil Porwal <kapilporwal(a)google.com> Gerrit-Reviewer: Krishna P Bhat D <krishna.p.bhat.d(a)intel.com> Gerrit-Reviewer: Subrata Banik <subratabanik(a)google.com> Gerrit-Reviewer: Vijay P Hiremath <vijay.p.hiremath(a)intel.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Deepti Deshatty <deepti.deshatty(a)intel.corp-partner.google.com> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Subrata Banik <subratabanik(a)google.com> Gerrit-Attention: Kapil Porwal <kapilporwal(a)google.com> Gerrit-Attention: Krishna P Bhat D <krishna.p.bhat.d(a)intel.com> Gerrit-Attention: Balaji Manigandan <balaji.manigandan(a)intel.com> Gerrit-Attention: Deepti Deshatty <deepti.deshatty(a)intel.com> Gerrit-MessageType: newpatchset

1 0

[S] Change in coreboot[main]: lib/lzmadecode: Allow for 8 byte reads on 64bit
by Subrata Banik (Code Review) 03 Jan '24

03 Jan '24

Attention is currently required from: Arthur Heymans. Subrata Banik has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/70175?usp=email ) Change subject: lib/lzmadecode: Allow for 8 byte reads on 64bit ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://review.coreboot.org/c/coreboot/+/70175?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I890c075307c0aec877618d9902ea352ae42a3bfa Gerrit-Change-Number: 70175 Gerrit-PatchSet: 2 Gerrit-Owner: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Reviewer: Subrata Banik <subratabanik(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Lean Sheng Tan <sheng.tan(a)9elements.com> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-CC: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Gerrit-Attention: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Comment-Date: Wed, 03 Jan 2024 05:04:02 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

[XS] Change in coreboot[main]: mb/asus/p8z77-m: Remove settings to replicate OEM
by Keith Hui (Code Review) 03 Jan '24

03 Jan '24

Attention is currently required from: Fabian Groffen, Keith Hui. Keith Hui has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/75137?usp=email ) Change subject: mb/asus/p8z77-m: Remove settings to replicate OEM ...................................................................... Patch Set 4: (1 comment) Patchset: PS3: > I found out why S3 didn't work for me, and it was not your patch. […] (fixed by CB:78205) -- To view, visit https://review.coreboot.org/c/coreboot/+/75137?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: Iae526762e79e9e2d46d06e12c338f375e5555e8c Gerrit-Change-Number: 75137 Gerrit-PatchSet: 4 Gerrit-Owner: Fabian Groffen <grobian(a)gentoo.org> Gerrit-Reviewer: Keith Hui <buurin(a)gmail.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Keith Hui <buurin(a)gmail.com> Gerrit-CC: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Gerrit-Attention: Keith Hui <buurin(a)gmail.com> Gerrit-Attention: Fabian Groffen <grobian(a)gentoo.org> Gerrit-Comment-Date: Wed, 03 Jan 2024 02:28:17 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Keith Hui <buurin(a)gmail.com> Comment-In-Reply-To: Fabian Groffen <grobian(a)gentoo.org> Gerrit-MessageType: comment

1 0

[S] Change in coreboot[main]: vboot: Add firmware PCR support
by Yi Chou (Code Review) 03 Jan '24

03 Jan '24

Attention is currently required from: Andrey Pronin, Andrey Pronin, Christian Walter, Julius Werner, Paul Menzel, Yu-Ping Wu. Yi Chou has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/79437?usp=email ) Change subject: vboot: Add firmware PCR support ...................................................................... Patch Set 7: (1 comment) Commit Message: https://review.coreboot.org/c/coreboot/+/79437/comment/2e18dfff_14fdf10b : PS6, Line 24: to 10 (and we plan to use PCR 12 for kernel version). > double-extension prevention for PCR0 is a very special case. […] Done. Removed the usage of PCR12, and combined them into the PCR10. -- To view, visit https://review.coreboot.org/c/coreboot/+/79437?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I601ad31e8c893a8e9ae1a9cdd27193edce10ec61 Gerrit-Change-Number: 79437 Gerrit-PatchSet: 7 Gerrit-Owner: Yi Chou <yich(a)google.com> Gerrit-Reviewer: Andrey Pronin <apronin(a)chromium.org> Gerrit-Reviewer: Christian Walter <christian.walter(a)9elements.com> Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: Yu-Ping Wu <yupingso(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Andrey Pronin <apronin(a)google.com> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Andrey Pronin <apronin(a)google.com> Gerrit-Attention: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Christian Walter <christian.walter(a)9elements.com> Gerrit-Attention: Julius Werner <jwerner(a)chromium.org> Gerrit-Attention: Andrey Pronin <apronin(a)chromium.org> Gerrit-Attention: Yu-Ping Wu <yupingso(a)google.com> Gerrit-Comment-Date: Wed, 03 Jan 2024 01:47:51 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Andrey Pronin <apronin(a)google.com> Comment-In-Reply-To: Julius Werner <jwerner(a)chromium.org> Comment-In-Reply-To: Yi Chou <yich(a)google.com> Gerrit-MessageType: comment

1 0

[S] Change in coreboot[main]: vboot: Add firmware PCR support
by Yi Chou (Code Review) 03 Jan '24

03 Jan '24

Attention is currently required from: Andrey Pronin, Christian Walter, Julius Werner, Paul Menzel, Yi Chou, Yu-Ping Wu. Hello Andrey Pronin, Christian Walter, Julius Werner, Yu-Ping Wu, build bot (Jenkins), I'd like you to reexamine a change. Please visit https://review.coreboot.org/c/coreboot/+/79437?usp=email to look at the new patch set (#7). Change subject: vboot: Add firmware PCR support ...................................................................... vboot: Add firmware PCR support To verify the boot chain, we will need to extend the PCR with the firmware version. And the server will be able to attest the firmware version of devices. The "firmware version" here is the RW firmware anti-rollback version, determined by the ChromeOS's signing infra, and will be verified in vb2api_fw_phase3, by comparing it with the version stored in the TPM. This version will be increased when there is critical vulnerability in the RW firmware. According to [1], PCRs 8-15 usage is defined by Static OS. Therefore PCR_FW_VER is chosen to be within that range. Ideally the existing PCR_BOOT_MODE and PCR_HWID should also be allocated in the same range, but unfortunately it's too late to fix them. Because PCRs 11 and 13 have been used for other purposes in ChromeOS, here PCR_FW_VER is set to 10. [1] https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClient_PFP_r1p05… BUG=b:248610274 TEST=Boot the device, and check the PCR 10 BRANCH=none Signed-off-by: Yi Chou <yich(a)google.com> Change-Id: I601ad31e8c893a8e9ae1a9cdd27193edce10ec61 --- M src/security/tpm/Kconfig M src/security/vboot/tpm_common.c M src/security/vboot/vboot_logic.c 3 files changed, 13 insertions(+), 2 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/37/79437/7 -- To view, visit https://review.coreboot.org/c/coreboot/+/79437?usp=email To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: main Gerrit-Change-Id: I601ad31e8c893a8e9ae1a9cdd27193edce10ec61 Gerrit-Change-Number: 79437 Gerrit-PatchSet: 7 Gerrit-Owner: Yi Chou <yich(a)google.com> Gerrit-Reviewer: Andrey Pronin <apronin(a)chromium.org> Gerrit-Reviewer: Christian Walter <christian.walter(a)9elements.com> Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: Yu-Ping Wu <yupingso(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Andrey Pronin <apronin(a)google.com> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Christian Walter <christian.walter(a)9elements.com> Gerrit-Attention: Julius Werner <jwerner(a)chromium.org> Gerrit-Attention: Yi Chou <yich(a)google.com> Gerrit-Attention: Andrey Pronin <apronin(a)chromium.org> Gerrit-Attention: Yu-Ping Wu <yupingso(a)google.com> Gerrit-MessageType: newpatchset

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

coreboot-gerrit January 2024