Issue #420 has been reported by Krystian Hebel.
----------------------------------------
Feature #420: Use standard format of TPM event log
https://ticket.coreboot.org/issues/420
* Author: Krystian Hebel
* Status: New
* Priority: Normal
* Target version: none
* Start date: 2022-10-12
* Related links: [1] https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientImplementa…
[2] https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClient_PFP_r1p05…
--------------------------------…
[View More]--------
Currently coreboot uses proprietary format for TPM event log. TCG has standardized log formats, differently for TPM1.2 (aka legacy or SHA1) [1] and TPM2.0 (aka crypto agile) [2], both of which can be parsed by Linux kernel and exposed in sysfs. I don't know of any tool outside of cbmem which can parse coreboot format; this includes payloads which may be interested in continuing chain of trust started by coreboot.
Another incompatibility is caused by vboot's assignment of PCRs. Roles of PCRs are roughly specified by TCG in both of mentioned documents, they are more or less compatible with each other, but not with current coreboot code.
These changes could break assumptions made by existing platforms, so they should be made as Kconfig options.
This is a tracking issue to collect subtasks that need to be done in order to support standard event log formats.
--
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: https://ticket.coreboot.org/my/account
[View Less]
Issue #433 has been reported by Michał Żygowski.
----------------------------------------
Feature #433: Unify TPM drivers in coreboot
https://ticket.coreboot.org/issues/433
* Author: Michał Żygowski
* Status: New
* Priority: Normal
* Target version: none
* Start date: 2022-10-24
----------------------------------------
Add an option to compile all drivers for TPM 1.2, 2.0 TIS and CRB. The motivation is to not build multiple coreboot ROMs for each possible TPM supported by the platform.
The …
[View More]tasks would include:
- runtime TPM detection (probing TPM_INTF_CAPABILITY and TPM_INTERFACE_ID)
- rename the TPM driver functions, make them static and expose them as a driver structure, e.g.
struct tpm_driver {
void (*init)(void);
int (*open)(void);
int (*close)(void);
int (*sendrecv)(const uint8_t *sendbuf, size_t send_size, uint8_t *recvbuf, size_t *recv_len);
}
- based on the detected TPM, hook the tpm_driver functions to provide the global TPM API: tis_open, tis_close, tis_init, tis_sendrecv. Some additional API to get vendor/device name could also be considered.
--
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: https://ticket.coreboot.org/my/account
[View Less]
Hi folks,
Another leap year, another problem with RTC in firmwares :) This time,
unfortunately, this kind of bugs hit coreboot.
I have issued a patch that fixes off-by-one error in the days count in
month for a leap year:
https://review.coreboot.org/c/coreboot/+/80790
It is quite critical, because depending on build date, it may revert to
some very old date, like January 2023 or even older (depending on how
long you run on current firmware). That said, the consequences are
enormous: from …
[View More]false-negative expired certificates, to problems with
filesystems, etc.
It is worth considering an emergency coreboot release, is it not?
Best regards,
--
Michał Żygowski
Firmware Engineer
GPG: 6B5BA214D21FCEB2
https://3mdeb.com | @3mdeb_com
[View Less]
Hey Julius,
Here's what we running:
https://review.coreboot.org/plugins/gitiles/coreboot/+/refs/heads/main/util…
Martin
Feb 27, 2024 at 18:31 by jwerner(a)chromium.org:
> Hi,
>
> We've had unit test support in libpayload for over two years now, but
> I just noticed that it doesn't look like we're actually running them
> in the CI? E.g. if I look through a test run like this
> https://qa.coreboot.org/job/coreboot-gerrit/252761/testReport/(root)/
> I can't find them …
[View More]anywhere (most of them have confusingly similar
> names with coreboot unit tests, but "fmap_locate_area-test" is a
> unique one).
>
> Is that intended or an oversight? Would it be easy to fix? (I'm not
> super familiar with how the tests are integrated into Jenkins, but the
> libpayload framework is pretty much a direct copy of the coreboot
> framework, so if we can run the coreboot ones hopefully it should be
> easy to run the libpayload ones as well?)
> _______________________________________________
> coreboot mailing list -- coreboot(a)coreboot.org
> To unsubscribe send an email to coreboot-leave(a)coreboot.org
>
[View Less]
Hi community
I picked up the good work done by Jacob Garber to implement link time
optimization. The size gains are very substantial, with sometimes up to 15%
reduction in binary size! Besides the size benefit it can make us a bit
more lazy programmers: for instance we often put static inline functions in
headers guarded by preprocessing depending on Kconfig options to not
generate code we won't use. With LTO that can be relaxed a bit and the
condition to do nothing can come from a separate …
[View More]linked object (at least I
presume, I haven't tested).
So to do LTO, both with clang and GCC, you use the compiler as a linker
frontend, rather than invoke the linker directly. Object files that are
optionally generated with the -flto flag to generate LTO optimized
binaries. See https://review.coreboot.org/c/coreboot/+/40811
Jacob's patches dealt with GCC. I toyed around with clang. The clang linker
frontend only works with LTO if using the GOLD or LLD linker. GCC can use
the BFD linker we currently use, so that's an easy transition. Both those
linkers, GOLD and LLD are less capable at parsing linker scripts than the
BFD linker. Especially for the x86 bootblock, in which we do a lot of
stuff, like ID, FIT pointer, ECFW pointer, early 16 bit code, ..., is
complicated and those linkers fail on the arithmetics doing all that
optimized linking.
So my question would be, whether we want to support non BFD linkers and
therefore not support all the magic in linker scripts we currently have. At
most we are a few bytes less optimal than possible by for instance setting
a good hardcoded size and offset of the early 16bit code rather than have
the linker script optimize that. As a side note, LTO size gainz are bigger
than what would be lost, by a large margin.
https://review.coreboot.org/c/coreboot/+/80724/1/src/arch/x86/bootblock.ld
is a crude example of how I got lld to be happy with the script.
If non BFD linkers are acceptable, how do you propose we deal with it? When
not using LTO you could in principle use a different linker of your
choosing. Should we just move to lld to make sure CI is happy about linker
scripts? Should it be an option, but then we won?t have CI being able to
test it except on a few boards put in configs/ ? Maybe have both, but then
change the default once LLD is known to work well enough? Sidenote: LLD is
faster than BFD but linking is not an expensive step in coreboot anyway.
Other more typical linker scripts like the ones you find on ARM and ARM64
platforms work just fine. There are some subtle differences e.g.
https://review.coreboot.org/c/coreboot/+/80735 where the heap needs to be
declared to not be loaded.
There are a few issues though. LLD does not like the RISCV relocation
symbols of libgcc.a... I read upstream bugreports about this issue, so
maybe that will resolve itself.
Same questions with LTO and CI. Should it be an option (IMO yes, as that's
what both Linux and u-boot do) and which default settings do we want. For
CI reasons LTO is a bit more strict and therefore useful, as the compiler
frontend does throw more warnings than the plain linker when linking.
What are your thoughts? Are there some caveats about linkers and LTO that
are worth knowing, before moving forward?
Kind regards
Arthur
[View Less]
Hi folks,
As discussed in the Feb. 21 coreboot leadership meeting [1][2], concerns have been raised about coreboot source code releases for certain Meraki switch products. Requests have been made to open-source(a)meraki.com (mailto:open-source@meraki.com) about this with limited success in the past (MX84, MX250), though current requests for MS350 have gone practically unanswered. Since this problem scales with the product line-up, it seems an engineering approach to get code published - …
[View More]preferably upstream - will be a better way to solve it rather than repeated requests or escalation to the SFC.
We're looking for anyone from Meraki/Cisco who would like to solve this by getting the code published. Several members of the coreboot community have experience working at (or with) companies in similar situations, and we're willing to help with this process. A few quick ideas mentioned in the recent meeting include a packaging tool to remove unused modules, a repo or branch on coreboot.org to host Meraki changes if they can't be mainlined easily, a license package that can integrate with Meraki's OS installer, etc.
It's great that coreboot is used on these products and we believe that the coreboot community and corporate users such as Meraki mutually benefit when everyone's rights are respected. We strongly prefer an engineering approach to compliance with the GPLv2, but will look to other options if progress can't be made.
If anyone at Meraki/Cisco happens to be reading this, feel free to contact me privately.
[1] https://docs.google.com/document/d/1NRXqXcLBp5pFkHiJbrLdv3Spqh1Hu086HYkKrgK… (https://docs.google.com/document/d/1NRXqXcLBp5pFkHiJbrLdv3Spqh1Hu086HYkKrgK…)
[2] https://www.mail-archive.com/coreboot@coreboot.org/msg58333.html (https://www.mail-archive.com/coreboot@coreboot.org/msg58333.html)
[View Less]
Hi,
We've had unit test support in libpayload for over two years now, but
I just noticed that it doesn't look like we're actually running them
in the CI? E.g. if I look through a test run like this
https://qa.coreboot.org/job/coreboot-gerrit/252761/testReport/(root)/
I can't find them anywhere (most of them have confusingly similar
names with coreboot unit tests, but "fmap_locate_area-test" is a
unique one).
Is that intended or an oversight? Would it be easy to fix? (I'm not
super familiar …
[View More]with how the tests are integrated into Jenkins, but the
libpayload framework is pretty much a direct copy of the coreboot
framework, so if we can run the coreboot ones hopefully it should be
easy to run the libpayload ones as well?)
[View Less]
I notice in bfb11bec3b3fec638adf864a9b9b2cff6671fed8 that CHIP_NAME is
gone.
I am glad to see it go, but I figured a quick note on history would help.
Back in the day, we had coreboot on systems with as little as 256 KiB of
memory. That was hard. One of the build options was to have CHIP_NAME
result in "", which saved the length of the string + 4 bytes (the pointer).
This was, on occasion, the difference between fitting an image or
overflowing. It mattered.
So the comment:
" It was …
[View More]decided to remove this macro altogether, as it does not do
anything special and incurs a maintenance burden."
is accurate now, since CHIP_NAME always returns the string.
But in the era in which CHIP_NAME was created, this comment is not correct.
[View Less]
Hi coreboot community,
The Open-Source Firmware Foundation (OSFF) is pleased to announce
ByteTalks, a new series of online webinars focused on the open-source
firmware community. ByteTalks aims to provide a platform for learning,
sharing, and discussing the latest developments in open-source firmware.
Each session features talks by experienced professionals, practical
tutorials, and a chance for participants to ask questions and engage
with the speakers. Whether you're deeply involved in …
[View More]firmware
development or just interested in learning more about the field,
ByteTalks offers valuable insights and connections to help you grow.
Join us to explore the evolving world of open-source firmware together.
Announcing OSFF ByteTalks Vol. 1: “*FSP Customization - Remove
non-mandatory components in the Intel FSP*”
In the realm of open-source firmware, creating a custom Firmware Support
Package (FSP) binary is a pivotal step for developers aiming to enhance
hardware compatibility and performance. The process involves
understanding the hardware's initialization requirements, integrating
coreboot or similar open-source firmware solutions, and customizing the
FSP to meet specific system needs. Our guests Subrata and Vincent will
talk about the process on customizing the Intel FSP and removing
non-mandatory components.
For more information, check out the event page here:
https://osfw.foundation/events/bytetalks-vol.-1/
In case you have any questions, feel free to reach out to me. In case
you are also interested in joining the ByteTalks series as a speaker,
feel free to reach out to me as well :)
Best,
Chris
--
*Christian Walter*
Open-Source Firmware Foundation
Email: christian.walter(a)osfw.foundation
[View Less]
Issue #527 has been reported by naixin Lv.
----------------------------------------
Bug #527: Can't compile coreboot on Arch Linux
https://ticket.coreboot.org/issues/527
* Author: naixin Lv
* Status: New
* Priority: Normal
* Assignee: naixin Lv
* Category: build system
* Target version: none
* Start date: 2024-02-23
* Affected versions: master
* Needs backport to: none
* Affected hardware: GIGABYTE GA-H61M-DS2
* Affected OS: none
----------------------------------------
I want to compile …
[View More]coreboot for my Gigabyte GA-H61M-DS2 mainboard, but I only found a short guide for this board at this site: https://www.iot-tech.dev/full.php?ar=166
After downloaded the coreboot git repository, It gave me this error:
``` shell
/home/zhongli/coreboot/util/crossgcc/xgcc/bin/x86_64-elf-ld.bfd: build/romstage/console/vtxprintf.o: in function `number':
/home/zhongli/coreboot/src/console/vtxprintf.c:63:(.text.number+0x12b): undefined reference to `__udivmoddi4'
/home/zhongli/coreboot/util/crossgcc/xgcc/bin/x86_64-elf-ld.bfd: build/romstage/lib/gcc.o: in function `__wrap___divdi3':
/home/zhongli/coreboot/src/lib/gcc.c:19:(.text.__wrap___divdi3+0x1): undefined reference to `__divdi3'
/home/zhongli/coreboot/util/crossgcc/xgcc/bin/x86_64-elf-ld.bfd: build/romstage/lib/gcc.o: in function `__wrap___udivdi3':
/home/zhongli/coreboot/src/lib/gcc.c:20:(.text.__wrap___udivdi3+0x1): undefined reference to `__udivdi3'
make: *** [src/arch/x86/Makefile.mk:191: build/cbfs/fallback/romstage.debug] Error 1
```
And I'll put my config file on here.
Any help ?
---Files--------------------------------
defconfig (726 Bytes)
ifd_shrinked.bin (4 KB)
me_shrinked.bin (96 KB)
--
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: https://ticket.coreboot.org/my/account
[View Less]