coreboot March 2024

coreboot@coreboot.org

19 participants
34 discussions

[coreboot - Feature #420] (New) Use standard format of TPM event log
by Krystian Hebel 07 Aug '24

07 Aug '24

Issue #420 has been reported by Krystian Hebel. ---------------------------------------- Feature #420: Use standard format of TPM event log https://ticket.coreboot.org/issues/420 * Author: Krystian Hebel * Status: New * Priority: Normal * Target version: none * Start date: 2022-10-12 * Related links: [1] https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientImplementa… [2] https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClient_PFP_r1p05… ---------------------------------------- Currently coreboot uses proprietary format for TPM event log. TCG has standardized log formats, differently for TPM1.2 (aka legacy or SHA1) [1] and TPM2.0 (aka crypto agile) [2], both of which can be parsed by Linux kernel and exposed in sysfs. I don't know of any tool outside of cbmem which can parse coreboot format; this includes payloads which may be interested in continuing chain of trust started by coreboot. Another incompatibility is caused by vboot's assignment of PCRs. Roles of PCRs are roughly specified by TCG in both of mentioned documents, they are more or less compatible with each other, but not with current coreboot code. These changes could break assumptions made by existing platforms, so they should be made as Kconfig options. This is a tracking issue to collect subtasks that need to be done in order to support standard event log formats. -- You have received this notification because you have either subscribed to it, or are involved in it. To change your notification preferences, please click here: https://ticket.coreboot.org/my/account

4 12

[coreboot - Feature #433] (New) Unify TPM drivers in coreboot
by Michał Żygowski 24 Apr '24

24 Apr '24

Issue #433 has been reported by Michał Żygowski. ---------------------------------------- Feature #433: Unify TPM drivers in coreboot https://ticket.coreboot.org/issues/433 * Author: Michał Żygowski * Status: New * Priority: Normal * Target version: none * Start date: 2022-10-24 ---------------------------------------- Add an option to compile all drivers for TPM 1.2, 2.0 TIS and CRB. The motivation is to not build multiple coreboot ROMs for each possible TPM supported by the platform. The tasks would include: - runtime TPM detection (probing TPM_INTF_CAPABILITY and TPM_INTERFACE_ID) - rename the TPM driver functions, make them static and expose them as a driver structure, e.g. struct tpm_driver { void (*init)(void); int (*open)(void); int (*close)(void); int (*sendrecv)(const uint8_t *sendbuf, size_t send_size, uint8_t *recvbuf, size_t *recv_len); } - based on the detected TPM, hook the tpm_driver functions to provide the global TPM API: tis_open, tis_close, tis_init, tis_sendrecv. Some additional API to get vendor/device name could also be considered. -- You have received this notification because you have either subscribed to it, or are involved in it. To change your notification preferences, please click here: https://ticket.coreboot.org/my/account

4 6

[coreboot - Support #534] (New) Enable Ethernet (LAN) on ADL-P Custom Board
by Mahesh Kilumu 08 Apr '24

08 Apr '24

Issue #534 has been reported by Mahesh Kilumu. ---------------------------------------- Support #534: Enable Ethernet (LAN) on ADL-P Custom Board https://ticket.coreboot.org/issues/534 * Author: Mahesh Kilumu * Status: New * Priority: Normal * Category: coreboot common code * Target version: 4.21 * Start date: 2024-03-21 ---------------------------------------- Hi, With respect to the Alderlake-P RVP platform designed Custom Board. i have been trying to implement the Ethernet(LAN) on my Custom Board. on RVP intel team used GBE PHY but on my custom board we have used the External Realtek RTL8111H controller over PCIe Root port7 for Ethernet. Below are the configuration details: 1) Devicetree.cb: device ref pcie_rp7 on end # Enable PCH PCIE RP 7 using CLK 6 register "pch_pcie_rp[PCH_RP(7)]" = "{ .clk_src = 6, .clk_req = 6, .flags = PCIE_CLK_LAN }" 2) gpio.c: /* 19: PCIE SRCCLKREQ6- same as RVP */ PAD_CFG_NF(GPP_F19, NONE, DEEP, NF1), /* 2: GPD_2_LAN_WAKE_N- same as RVP*/ PAD_CFG_NF(GPD2, NONE, DEEP, NF1), /* 21 : LAN_ISOLATE# -New Implementation */ PAD_CFG_GPO(GPP_A21, 1, DEEP), from the logs observed that, Root port got enabled ->> [SPEW ] PCI: 00:00:1c.6: enabled 1 But observed the few Error & warnings in the log with respect to the above configuration [WARN ] Missing root port clock structure definition [ERROR] PCI: 00:00:1c.6 missing read_resources full log details : https://pastebin.com/zWcsEZvL -- You have received this notification because you have either subscribed to it, or are involved in it. To change your notification preferences, please click here: https://ticket.coreboot.org/my/account

1 4

[coreboot - Bug #533] (New) T440p audio mute button and fan control not working
by frantic from xboot 05 Apr '24

05 Apr '24

Issue #533 has been reported by frantic from xboot. ---------------------------------------- Bug #533: T440p audio mute button and fan control not working https://ticket.coreboot.org/issues/533 * Author: frantic from xboot * Status: New * Priority: Normal * Target version: master * Start date: 2024-03-07 * Affected versions: master * Affected hardware: Lenovo Thinkpad T440p * Affected OS: All Linux distributions ---------------------------------------- In recent coreboot versions, the audio mute button and fan control has stopped working. Whereas you use the same revision from Libreboot, it all works fine and smoothly. This leads me to suspect that someone changed someone without testing, which is real annoying. The audio mute button technically still functions, but the LED no longer turns on/off. Always just off. Fan control no longer works with Thinkfan. /proc/acpi/ibm/fan doesn't exist any more. I've tried "force loading" thinkpad_acpi, but it doesn't work. -- You have received this notification because you have either subscribed to it, or are involved in it. To change your notification preferences, please click here: https://ticket.coreboot.org/my/account

3 14

coreboot Meetings Announcement And Agenda Call
by mina＠coreboot.org 29 Mar '24

29 Mar '24

Dear community, Kindly note that the upcoming coreboot leadership meeting is scheduled for Wednesday, April 3, 2024.[1] Please take a moment to update the current agenda items with matters you wish to see addressed during the meeting. [2] [1](https://www.coreboot.org/calendar.html). [2](https://docs.google.com/document/d/1NRXqXcLBp5pFkHiJbrLdv3Spqh1Hu086HYkK….

1 0

New Defects reported by Coverity Scan for coreboot
by scan-admin＠coverity.com 24 Mar '24

24 Mar '24

Hi, Please find the latest report on new defect(s) introduced to coreboot found with Coverity Scan. 1 new defect(s) introduced to coreboot found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1540835: Null pointer dereferences (REVERSE_INULL) /util/amdfwtool/amdfwtool.c: 533 in fill_dir_header() ________________________________________________________________________________________________________ *** CID 1540835: Null pointer dereferences (REVERSE_INULL) /util/amdfwtool/amdfwtool.c: 533 in fill_dir_header() 527 psp_directory_table *dir = directory; 528 bios_directory_table *bdir = directory; 529 /* The cookies have same offsets. */ 530 uint32_t cookie = ((psp_directory_table *)directory)->header.cookie; 531 uint32_t table_size = 0; 532 >>> CID 1540835: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "directory" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 533 if (ctx == NULL || directory == NULL) { 534 fprintf(stderr, "Calling %s with NULL pointers\n", __func__); 535 return; 536 } 537 538 /* The table size needs to be 0x1000 aligned. So align the end of table. */ ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=u001.AxU2LYlgjL6eX23u9ErQy-2…

1 0

[PATCH] Add missing malloc check in libpayload
by Abhinav Srivastava 23 Mar '24

23 Mar '24

Fixes #496: Add NULL check for malloc in get_option_as_string to prevent potential crashes from unhandled memory allocation failures. Signed-off-by: Abhinav Srivastava <atg271(a)gmail.com> --- payloads/libpayload/drivers/options.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/payloads/libpayload/drivers/options.c b/payloads/libpayload/drivers/options.c index b6d234222d..7571fd739a 100644 --- a/payloads/libpayload/drivers/options.c +++ b/payloads/libpayload/drivers/options.c @@ -318,6 +318,9 @@ int get_option_as_string(const struct nvram_accessor *nvram, struct cb_cmos_opti /* extra byte to ensure 0-terminated strings */ raw = malloc(cmos_length+1); + if (!raw) { + return -1; + } memset(raw, 0, cmos_length+1); int ret = get_option_with(nvram, option_table, raw, name); -- 2.34.1

1 0

2024-03-20 - coreboot Leadership Meeting Minutes
by mina＠coreboot.org 21 Mar '24

21 Mar '24

# 2024-03-20 - coreboot Leadership Meeting Minutes ## Attendees Martin Roth, Felix Held, Felix Singer, Jay Talbott, Matt DeVillier, Nicholas Chin, David Hendricks, Arthur Heymans, Mina Asante, Julius Werner,Christian Walter, Max Brune, Jon Murphy, Karthik, Patrick Georgi. ## Announcements * FOSSY conference: August 1-4 2024 in Portland, Oregon, USA [https://sfconservancy.org/fossy/]. * OSFC will be in Bochum Germany - September 3-5 - [https://www.osfc.io/]. ## Open Action Items * 2024-03-20 * [Open] Martin: Set up a new meeting link for the next leadership meeting. * [Open] Martin: Add a note to the gerrit guidelines to email the leadership. * 2024-03-06 * [Open] Martin: To update documentation on gerrit contributing guidelines. * https://doc.coreboot.org/contributing/index.html * 2024-01-10 * [Open] Werner: Push patch based on https://ticket.coreboot.org/issues/522 * Nico: https://review.coreboot.org/q/topic:enforce_region_api * Open Daniel: Look at how we want to localize (non console) strings for coreboot. Long term project. ## Minutes ### [Martin] BigBlueButton * The invite for this meeting still has the google chat link on it. We should have Patrick cancel his invite and set up a new one. * The BBB version that the SFC offers is from 2021 and has issues on mobile. There could also be unfixed CFEs (speculation). * Do we want to switch back to Google chat until the SFC can update to a newer version? Martin can set up an open invite for up to 100 users. $20 per month (I believe). * Can also use OSFF - 250 people, record, etc - everyone can join. * Decision: switch back to Google Meet ### [Martin] Adding Max Brune and Jon Murphy as core developers. * | Name | Patches | Reviews | Comments |First Patch | |------------------|---------|---------|----------|------------| | Maximilian Brune | 67 | 88 | 43 | 2022-05-16 | | Jon Murphy | 115 | 130 | 29 | 2022-02-24 | * Others who could be considered, but we’d like to see more community involvement, reviews, and/or comments from before considering them. * Frans Hendriks * Bora Guvendik * Keith Hui * Maulik Vaghela * Naresh Solanki * Tyler Wang * Varshit B Pandya * Kapil Porwal * If anyone feels that I’m mistaken about people in either group, please reach out to me or the leadership about these people. * [FelixH] We should only look at the number of commits and things from the past 2 years instead of over the entire span that they’ve been working on the project. * [Martin] I can recalculate who other than Max & Jon could be considered. * Decision: Only look at the past 2 years? * [Felix] How should we react when people don’t do a good job submitting code? * [Martin] I think that the leadership should talk with the user. * [MattD] No formal policy - let the leadership handle it. * TODO: Add a note to the gerrit guidelines to email the leadership ### [Martin] RFC: Link Time Optimization [LTO] * Jacob Garber pushed patches a few years ago to get GCC working - Arthur took these over. See Jacob’s initial email: [https://mail.coreboot.org/hyperkitty/list/coreboot@coreboot.org/message/JII…] * Working on adding clang - works differently & only works with specific linkers. [https://mail.coreboot.org/hyperkitty/search?q=lto&page=1&mlist=coreboot%40c…] * Do we want to make this a default? * [Martin] We can decide that after testing. * [Arthur] ARM (not arm64) is broken - maybe the toolchain is broken. Arm builds don’t even complete. * Would there be a reason to keep non-LTO? * Maybe to debug issues and see if they’re caused by LTO. * To add LLVM with LTO we need to add LLD as part of the project when building LLVM. * How does this affect our linker scripts? * LLD doesn’t understand “=.” but setting a variable works. ### [Martin] Bugs * Large number of outstanding bugs - how can we close these? No good solution? * Reduce barriers * Introducing single sign-on would help. * Having the email to the mailing list seems to help. * Being able to reply to the email and have it show up in the bug would help. * Why is tracker.coreboot.org down right now? * Is there any progress integrating with Gerrit? * Felix would like to move away from redmine. Highly depends on plugins and there isn’t good modern functionality. Removed support from open-connect - so people can’t use * Propose we switch to forgejo for bug tracking. * Can we use our current logins from gerrit, or does it require a new login? This is the biggest issue we’ve heard from users with redmine. * Does this help integration with gerrit? * What are we looking for? * Links from bugids from gerrit to the ticket. * Yes? I think we can do this just with gerrit. The same as we do with the CB: links. * Decision: Let’s look at Forgejo and see ### [Martin] Coverity issues * Current open issues spreadsheet * [chart of issues by area] (https://docs.google.com/spreadsheets/d/e/2PACX-1vRYUlOLQTysbdPQoOKaCnRN_K4C… 6gATqtvgDlzSl1S4DaijcTyF7yAAs3qm/pubchart?oid=502535263&format=interactive). * [chart of issues by type] (https://docs.google.com/spreadsheets/d/e/2PACX-1vRYUlOLQTysbdPQoOKaCnRN_K4C… 6gATqtvgDlzSl1S4DaijcTyF7yAAs3qm/pubchart?oid=1369215095&format=interactive). * Link to the coreboot project coverity:[https://scan.coverity.com/projects/coreboot]. * As an alternative to coverity, Felix is adding a code-checker Docker container, and we’ll be moving to it from the current scan-build website. This is not a replacement for coverity, just a nicer interface to the current scan-build that we’re already doing. * [https://codechecker.readthedocs.io/en/latest/]. * coreboot.org/scan-build is currently broken. :( # Next meeting * April 3, 2024. * [coreboot Calendar](https://coreboot.org/calendar.html). # Notice * Decisions shown here are not necessarily final, and are based on the current information available. If there are questions or comments about decisions made, or additional information to present, please put it on the leadership meeting agenda and show up if possible to discuss it. Of course items may also be discussed on the mailing list, but as it's difficult to interpret tone over email, controversial topics frequently do not have good progress in those discussions. For particularly difficult issues, it may be best to try to schedule another meeting. # coreboot leadership meeting minutes [2024-03-20](https://docs.google.com/document/d/1NRXqXcLBp5pFkHiJbrLdv3Spqh1… 1).

1 0

BootGuard policy decoder?
by mr gadha 20 Mar '24

20 Mar '24

Are there any known tools for decoding the BootGuard policy? I’m new to coreboot but have a system that I was interested in investigating adding support for it. The flash image has BootGuard signatures, but at least some parts of the UEFI area of the flash are modifiable (variables, logo, etc). I’m wondering if the DXE area is even protected at all… Or does one just abandon any attempt as soon as a BootGuard header is seen? Thanks!

4 4

Re: Gitiles broken?
by Martin Roth 19 Mar '24

19 Mar '24

Hey Julius, not a problem to bring it up. I'm sure that others were noticing it as well and just not saying anything. I just added notices to topics in irc, slack, and discord. I'll see what options we have for putting the GitHub browse link into Gerrit. Martin Mar 19, 2024 at 17:46 by jwerner(a)google.com: > Whoops, sorry for the noise then. I felt like I vaguely remembered > hearing something about it but then I guess I didn't search far enough > back in trying to find it in the mailing list and meeting notes. > > I don't suppose there's any (easy) way to get links to GitHub into > Gerrit in the repository list? I don't really care about which backend > we use, but I usually start searching on Gerrit when I'm trying to > remember how to browse the code online.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

coreboot March 2024