Attention is currently required from: Sean Rhodes.
Martin L Roth has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/81393?usp=email )
Change subject: mb/starlabs/starbook/{adl,rpl}: Disable CNVi
......................................................................
Patch Set 1: Code-Review+2
--
To view, visit https://review.coreboot.org/c/coreboot/+/81393?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: main
Gerrit-Change-Id: I3725465eae0c7ade3dafa03add151353818ee761
Gerrit-Change-Number: 81393
Gerrit-PatchSet: 1
Gerrit-Owner: Sean Rhodes <sean(a)starlabs.systems>
Gerrit-Reviewer: Martin L Roth <gaumless(a)gmail.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Attention: Sean Rhodes <sean(a)starlabs.systems>
Gerrit-Comment-Date: Thu, 21 Mar 2024 16:08:54 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
Gerrit-MessageType: comment
Attention is currently required from: Maximilian Brune, Patrick Georgi, Philipp Hug, ron minnich.
Martin L Roth has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/81410?usp=email )
Change subject: arch/riscv: add Kconfig variable RISCV_HAS_MENVCFG
......................................................................
Patch Set 1:
(1 comment)
Patchset:
PS1:
> makes no changes to any build
Why wouldn't this change the binary? You're adding code. Is that just not called yet?
--
To view, visit https://review.coreboot.org/c/coreboot/+/81410?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: main
Gerrit-Change-Id: I627dde377708cde2491d4abe625c482d64f7aa87
Gerrit-Change-Number: 81410
Gerrit-PatchSet: 1
Gerrit-Owner: ron minnich <rminnich(a)gmail.com>
Gerrit-Reviewer: Martin L Roth <gaumless(a)gmail.com>
Gerrit-Reviewer: Maximilian Brune <maximilian.brune(a)9elements.com>
Gerrit-Reviewer: Patrick Georgi <patrick(a)coreboot.org>
Gerrit-Reviewer: Philipp Hug <philipp(a)hug.cx>
Gerrit-Attention: Patrick Georgi <patrick(a)coreboot.org>
Gerrit-Attention: Philipp Hug <philipp(a)hug.cx>
Gerrit-Attention: Maximilian Brune <maximilian.brune(a)9elements.com>
Gerrit-Attention: ron minnich <rminnich(a)gmail.com>
Gerrit-Comment-Date: Thu, 21 Mar 2024 15:53:49 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: ron minnich <rminnich(a)gmail.com>
Gerrit-MessageType: comment
Attention is currently required from: Maximilian Brune, Patrick Georgi, Philipp Hug, ron minnich.
Martin L Roth has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/81410?usp=email )
Change subject: arch/riscv: add Kconfig variable RISCV_HAS_MENVCFG
......................................................................
Patch Set 1:
(2 comments)
Commit Message:
https://review.coreboot.org/c/coreboot/+/81410/comment/64a0e568_73c60256 :
PS1, Line 10: Provide a Kconfig variable, default y, to enable it.
What happens if it's enabled but not present in the chip vs if it's present but disabled? Is this definitely the correct direction for the option?
I assume that the printf is just a placeholder for the code that will actually do something with it which will come later?
File src/arch/riscv/payload.c:
https://review.coreboot.org/c/coreboot/+/81410/comment/f7ffee5b_a7ea961a :
PS1, Line 72: part
Nit: Chip? SOC?
Change it or not - up to you.
--
To view, visit https://review.coreboot.org/c/coreboot/+/81410?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: main
Gerrit-Change-Id: I627dde377708cde2491d4abe625c482d64f7aa87
Gerrit-Change-Number: 81410
Gerrit-PatchSet: 1
Gerrit-Owner: ron minnich <rminnich(a)gmail.com>
Gerrit-Reviewer: Martin L Roth <gaumless(a)gmail.com>
Gerrit-Reviewer: Maximilian Brune <maximilian.brune(a)9elements.com>
Gerrit-Reviewer: Patrick Georgi <patrick(a)coreboot.org>
Gerrit-Reviewer: Philipp Hug <philipp(a)hug.cx>
Gerrit-Attention: Patrick Georgi <patrick(a)coreboot.org>
Gerrit-Attention: Philipp Hug <philipp(a)hug.cx>
Gerrit-Attention: Maximilian Brune <maximilian.brune(a)9elements.com>
Gerrit-Attention: ron minnich <rminnich(a)gmail.com>
Gerrit-Comment-Date: Thu, 21 Mar 2024 15:52:53 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Gerrit-MessageType: comment
Attention is currently required from: Patrick Georgi, Stefan Reinauer, ron minnich.
Martin L Roth has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/81307?usp=email )
Change subject: Revert "make: add clang-format prepare-commit-msg hook"
......................................................................
Patch Set 1:
(1 comment)
File 3rdparty/intel-microcode:
https://review.coreboot.org/c/coreboot/+/81307/comment/5e3fc0da_2e33f50b :
PS1, Line 1: Subproject commit ece0d294a29a1375397941a4e6f2f7217910bc89
this shouldn't be part of this commit.
--
To view, visit https://review.coreboot.org/c/coreboot/+/81307?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: main
Gerrit-Change-Id: I9466cfb9807e1969e3f50ef6b0d26decd3c67203
Gerrit-Change-Number: 81307
Gerrit-PatchSet: 1
Gerrit-Owner: ron minnich <rminnich(a)gmail.com>
Gerrit-Reviewer: Martin L Roth <gaumless(a)gmail.com>
Gerrit-Reviewer: Patrick Georgi <patrick(a)coreboot.org>
Gerrit-Reviewer: Stefan Reinauer <stefan.reinauer(a)coreboot.org>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Attention: Patrick Georgi <patrick(a)coreboot.org>
Gerrit-Attention: Stefan Reinauer <stefan.reinauer(a)coreboot.org>
Gerrit-Attention: ron minnich <rminnich(a)gmail.com>
Gerrit-Comment-Date: Thu, 21 Mar 2024 15:46:42 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Gerrit-MessageType: comment
Attention is currently required from: Andrey Petrov, Angel Pons, Arthur Heymans, Michał Żygowski, Subrata Banik.
Sean Rhodes has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/65270?usp=email )
Change subject: soc/intel/apollolake: Add a loader for the IBB
......................................................................
Patch Set 75:
(2 comments)
File src/soc/intel/apollolake/bootflow.md:
https://review.coreboot.org/c/coreboot/+/65270/comment/4259b3ee_bed753da :
PS74, Line 11: When we enter the bootblock, the first 128k will be copied
: into the SRAM. This will contain the IBBL partition (bootblock)
: and whatever will fix of the IBB partition.
> Take a look at Figure 8-1 in doc 571119, it shows the SRAM layout at CPU reset. […]
Done
File src/soc/intel/apollolake/loader.c:
https://review.coreboot.org/c/coreboot/+/65270/comment/23f97a22_c3d856ed :
PS67, Line 31:
: uint32_t chunk_num;
: uint32_t state;
: uint32_t size;
: uint8_t ring_index;
: uint32_t sram_size = SHARED_SRAM_SIZE;
: uint32_t sram_base = SHARED_SRAM_BASE;
: uint32_t host_to_cse;
: uint32_t cse_to_host;
: uint32_t chunk_index = 0;
: uint32_t chunk_size;
: uint32_t number_of_chunks;
: uint32_t ibb_size_left;
: uint8_t *src;
: uint8_t *dst;
> You could reduce the scope of some variables
Done
--
To view, visit https://review.coreboot.org/c/coreboot/+/65270?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: main
Gerrit-Change-Id: Ia41e3909f8099d2ea864166e9ea03e10e40a1b68
Gerrit-Change-Number: 65270
Gerrit-PatchSet: 75
Gerrit-Owner: Sean Rhodes <sean(a)starlabs.systems>
Gerrit-Reviewer: Andrey Petrov <andrey.petrov(a)gmail.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-CC: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-CC: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-CC: Stefan Reinauer <stefan.reinauer(a)coreboot.org>
Gerrit-CC: Subrata Banik <subratabanik(a)google.com>
Gerrit-Attention: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Gerrit-Attention: Subrata Banik <subratabanik(a)google.com>
Gerrit-Attention: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-Attention: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Attention: Andrey Petrov <andrey.petrov(a)gmail.com>
Gerrit-Comment-Date: Thu, 21 Mar 2024 15:44:48 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Sean Rhodes <sean(a)starlabs.systems>
Comment-In-Reply-To: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Comment-In-Reply-To: Angel Pons <th3fanbus(a)gmail.com>
Comment-In-Reply-To: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-MessageType: comment
Attention is currently required from: Andrey Petrov, Arthur Heymans, Sean Rhodes, Werner Zeh.
Hello Andrey Petrov, Werner Zeh, build bot (Jenkins),
I'd like you to reexamine a change. Please visit
https://review.coreboot.org/c/coreboot/+/65272?usp=email
to look at the new patch set (#50).
The following approvals got outdated and were removed:
Verified+1 by build bot (Jenkins)
Change subject: soc/intel/apollolake: Add support for IFWI Measured Boot
......................................................................
soc/intel/apollolake: Add support for IFWI Measured Boot
Add Measureed Boot that is specific to Apollolake, and is used
for measuring the IBBL, IBB and TXE. The IBB is measured only if it
exists, and only after it has been loaded into the CSE.
Signed-off-by: Sean Rhodes <sean(a)starlabs.systems>
Change-Id: I61ce4a34875d6d3357d4088167cdd887bafdff23
---
M src/soc/intel/apollolake/Makefile.mk
A src/soc/intel/apollolake/include/soc/fit.h
A src/soc/intel/apollolake/include/soc/measured_boot.h
A src/soc/intel/apollolake/measured_boot.c
4 files changed, 171 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/72/65272/50
--
To view, visit https://review.coreboot.org/c/coreboot/+/65272?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: main
Gerrit-Change-Id: I61ce4a34875d6d3357d4088167cdd887bafdff23
Gerrit-Change-Number: 65272
Gerrit-PatchSet: 50
Gerrit-Owner: Sean Rhodes <sean(a)starlabs.systems>
Gerrit-Reviewer: Andrey Petrov <andrey.petrov(a)gmail.com>
Gerrit-Reviewer: Werner Zeh <werner.zeh(a)siemens.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-CC: Stefan Reinauer <stefan.reinauer(a)coreboot.org>
Gerrit-Attention: Sean Rhodes <sean(a)starlabs.systems>
Gerrit-Attention: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Attention: Werner Zeh <werner.zeh(a)siemens.com>
Gerrit-Attention: Andrey Petrov <andrey.petrov(a)gmail.com>
Gerrit-MessageType: newpatchset
Attention is currently required from: Andrey Petrov, Arthur Heymans, Sean Rhodes, Subrata Banik.
Hello Andrey Petrov, build bot (Jenkins),
I'd like you to reexamine a change. Please visit
https://review.coreboot.org/c/coreboot/+/65270?usp=email
to look at the new patch set (#75).
The following approvals got outdated and were removed:
Verified+1 by build bot (Jenkins)
Change subject: soc/intel/apollolake: Add a loader for the IBB
......................................................................
soc/intel/apollolake: Add a loader for the IBB
Add a loader that will load the IBB into the CSE via the Ring Protocol
Buffer.
All registers were taken from Intel document number #336561.
Change-Id: Ia41e3909f8099d2ea864166e9ea03e10e40a1b68
Signed-off-by: Sean Rhodes <sean(a)starlabs.systems>
---
M src/soc/intel/apollolake/Makefile.mk
A src/soc/intel/apollolake/bootflow.md
A src/soc/intel/apollolake/include/soc/loader.h
A src/soc/intel/apollolake/loader.c
4 files changed, 207 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/70/65270/75
--
To view, visit https://review.coreboot.org/c/coreboot/+/65270?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: main
Gerrit-Change-Id: Ia41e3909f8099d2ea864166e9ea03e10e40a1b68
Gerrit-Change-Number: 65270
Gerrit-PatchSet: 75
Gerrit-Owner: Sean Rhodes <sean(a)starlabs.systems>
Gerrit-Reviewer: Andrey Petrov <andrey.petrov(a)gmail.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-CC: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-CC: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-CC: Stefan Reinauer <stefan.reinauer(a)coreboot.org>
Gerrit-CC: Subrata Banik <subratabanik(a)google.com>
Gerrit-Attention: Sean Rhodes <sean(a)starlabs.systems>
Gerrit-Attention: Subrata Banik <subratabanik(a)google.com>
Gerrit-Attention: Arthur Heymans <arthur(a)aheymans.xyz>
Gerrit-Attention: Andrey Petrov <andrey.petrov(a)gmail.com>
Gerrit-MessageType: newpatchset
Attention is currently required from: Andrey Petrov, Angel Pons, Michał Żygowski.
Hello Andrey Petrov, Angel Pons, build bot (Jenkins),
I'd like you to reexamine a change. Please visit
https://review.coreboot.org/c/coreboot/+/65680?usp=email
to look at the new patch set (#27).
The following approvals got outdated and were removed:
Verified+1 by build bot (Jenkins)
Change subject: soc/intel/apollolake: Create IBB, IBBL and OBB
......................................................................
soc/intel/apollolake: Create IBB, IBBL and OBB
coreboot's method of creating IFWI is to modify an existing IFWI
images by deleting the IBB, replacing the IBBL with the bootblock
and everything else is put in the OBB.
This poses a problem when using Intel's FIT or technologies such
as Boot Guard. The main problem is that the IBB is never verified by
the CSE or copied from SRAM to CAR, so the CSE cannot complete BUP
and stays in recovery mode. The vast majority of the stages in
Apollolake's Secure Boot flow is not met using this method (Intel
document number 597827 summarizes these steps).
This patch series is based on the principles of a patch from Brenton
Dong (CB:17064) creates an IBBL, IBB and OBB binaries with the
correct functions to complete the Secure Boot flow. This is to copy
the IBB from SRAM using the CSE's Ring Buffer Protocol.
These binaries can then be used by FIT or coreboot's existing
method of hacking IFWI together (IFWI_STITCH) via IFWITOOL. If it is
the latter and Boot Guard is enabled, the hashes for IFWI and "ibb+obb"
must be recreated.
Whilst this option doesn't form a complete image, the components it
builds will work as Intel intended them to once stitched correctly into
an IFWI image.
Signed-off-by: Sean Rhodes <sean(a)starlabs.systems>
Change-Id: I0deebf04f22f3017ee0c13bf1ca7f6dcc0d458b5
---
M src/soc/intel/apollolake/Makefile.mk
M src/southbridge/intel/common/firmware/Makefile.mk
2 files changed, 28 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/80/65680/27
--
To view, visit https://review.coreboot.org/c/coreboot/+/65680?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: main
Gerrit-Change-Id: I0deebf04f22f3017ee0c13bf1ca7f6dcc0d458b5
Gerrit-Change-Number: 65680
Gerrit-PatchSet: 27
Gerrit-Owner: Sean Rhodes <sean(a)starlabs.systems>
Gerrit-Reviewer: Andrey Petrov <andrey.petrov(a)gmail.com>
Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Lean Sheng Tan <sheng.tan(a)9elements.com>
Gerrit-CC: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Gerrit-CC: Stefan Reinauer <stefan.reinauer(a)coreboot.org>
Gerrit-Attention: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Gerrit-Attention: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-Attention: Andrey Petrov <andrey.petrov(a)gmail.com>
Gerrit-MessageType: newpatchset
Attention is currently required from: Andrey Petrov, Sean Rhodes.
Hello Andrey Petrov, build bot (Jenkins),
I'd like you to reexamine a change. Please visit
https://review.coreboot.org/c/coreboot/+/66103?usp=email
to look at the new patch set (#11).
The following approvals got outdated and were removed:
Verified+1 by build bot (Jenkins)
Change subject: soc/intel/apollolake: Add the Kconfig options for IFWI Boot Profile
......................................................................
soc/intel/apollolake: Add the Kconfig options for IFWI Boot Profile
The Boot Profile for use with the IFWI Boot Flow. The selected profile
should be equal to or higher than the one configured in IFWI.
No Profile
Since its inception, coreboot has ignored the Boot Flow designed by
Intel; this only uses an IBB and OBB. Neither are measured or verified
and mapped without assistance.
Legacy
Profile 0 is for platforms that do not wish to enable Boot Guard boot
block verification or measurement enforcement.
Verified
Profile 1 is strict Verification enforcement. It prevents unverified
BIOS components from running.
Verified and Measured
Boot Guard Profile 2 is strict Verification and Measurement
enforcement; this prevents unverified BIOS components from running.
Upon manufacturing completion, this value is burned into an FPF
and is permanent. This setting is only configurable when OEM signing
is enabled.
Signed-off-by: Sean Rhodes <sean(a)starlabs.systems>
Change-Id: I83d2fd134e1a893766f625fe2e2ddd81d48f9f8a
---
M src/soc/intel/apollolake/Kconfig
1 file changed, 82 insertions(+), 1 deletion(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/03/66103/11
--
To view, visit https://review.coreboot.org/c/coreboot/+/66103?usp=email
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: main
Gerrit-Change-Id: I83d2fd134e1a893766f625fe2e2ddd81d48f9f8a
Gerrit-Change-Number: 66103
Gerrit-PatchSet: 11
Gerrit-Owner: Sean Rhodes <sean(a)starlabs.systems>
Gerrit-Reviewer: Andrey Petrov <andrey.petrov(a)gmail.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Stefan Reinauer <stefan.reinauer(a)coreboot.org>
Gerrit-Attention: Sean Rhodes <sean(a)starlabs.systems>
Gerrit-Attention: Andrey Petrov <andrey.petrov(a)gmail.com>
Gerrit-MessageType: newpatchset