-
-
Notifications
You must be signed in to change notification settings - Fork 185
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update coreboot from 4.8.1 to 4.9 #500
Comments
Refer to pull request #501 |
Start the work!! :) I was expecting to see measured boot offered into coreboot to play with it on x230, asked @zaolin over slack if only the following platforms were supported:
On which he replied that all platforms were supported. Unfortunately, it doesn't seem to be the case. I see vboot being supported in all platforms, and measured boot being a suboption only for some boards: |
What patches should I be leaving out? I only have an X230 to test them on. |
As validating and porting all of the other patches so measure boot works for all supported boards before this PR being merged :) |
Can you contribute to my pull request? I can add you to my fork if you like. For now, I have coreboot 4.9 booting with the heads system. |
@JeffreyAbbinante FYI what @tlaurion is referring to is that the |
@flammit I understood what he meant. I am compiling a version with the patches already right now. |
@JeffreyAbbinante whoops - that's what I get for not reading the whole thread. sorry about that and thanks for the help! |
@flammit no problem. Would anyone happen to know what patches were merged into upstream? |
I'm unfortunately doing something else right now and can't review the patches. I've started, but since I did not see measure boot functions as I was expecting and the measured patch failed, I went to do other things after asking @zaolin for more information. Here is what I have in my bash history to test applicability of each patch:
The patches present under
Most of them were. You will see warnings from patch command requesting you if you want those changes to be applied in reverse (to undo the patch). I will resume attempts in the next following days but i'm really happy someone else is also taking a look at it :) Let us know where it hangs! |
So I took out my other laptop with a bit more processing power... to make compiling faster. I hope to find some stuff later this week. |
The measured boot patch needs work for sure. |
I went through the work of testing all the patches individually. This is what I got so far. Some of the patches were already applied but it seems like we all have a lot of work to do.
|
0007-intel-fsp-fsp2_0-Fix-FSP-2.0-headers-to-match-github.patch should be dropped, since coreboot now has the option to use the headers/binaries from the 3rdparty/fsp repo (which is a mirror of the Intel FSP github repo). Just requires changing the coreboot config for affected boards, which is trivial. |
Let's track measured boot WiP upstream in coreboot and switch to coreboot git commit id once it's merged? |
refer to #515 |
To be added in this PR
|
does this apply to the X230 too? Also, how about being lazy and bump coreboot with the next release that includes measured boot in vboot + support for the X230? I guess we'll have to do changes in userspace anyways? do we? which ones and who will do them? thanks! |
@merge: I have none of the answers right now. I just added information here to update status. From my understanding, those changes would work with the x230 as well but need to be tested. Yep, userspace will need to be adjusted also, since only a subset of PCRs are used now. I will find relative information on u-root and edit this post later on. @zaolin: your direct input would be more then welcome on the work needing to be done. Sent from my Galaxy S3 using FastHub-Libre |
@merge : from https://review.coreboot.org/c/coreboot/+/29547/73/Documentation/security/vboot/measured_boot.md userland tools will have to take into account sealing of only the following PCRs:
|
Estimation in man-days: 8 PD |
No description provided.
The text was updated successfully, but these errors were encountered: