delta/coreboot/vboot.git, branch release-R114-15437.B

scripts: Support compressed about_os_credits.html.

2023-04-25T00:20:57+00:00

BUG=b:187790036
BRANCH=none
TEST=ensure_not_tainted_license.sh /path/to/chromiumos_test_image.bin

Signed-off-by: Miriam Zimmerman 
Change-Id: Id3ad6535b1bc9635050d467208614f97e0aeca35
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4467627
Commit-Queue: Miriam Zimmerman 
Tested-by: Miriam Zimmerman 
Reviewed-by: Mike Frysinger

sign_official_build: Add support for a second miniOS key

2023-04-21T10:41:09+00:00

For recovery images, if minios_kernel.v1.keyblock exists, sign
- MINIOS-A with minios_kernel.v1.keyblock
- MINIOS-B with minios_kernel.keyblock
Otherwise, sign both with minios_kernel.keyblock.

BRANCH=None
BUG=b:266502803
TEST=- Run replace_recovery_key.sh in devkeys directory to get test keys
- Run sign_official_build.sh on a nissa recovery image
- Set recovery_key.v1.vbpubk in GBB and run recovery. After recovery
  completes, check NBR still works.
- Repeat with recovery_key.vbpubk.

Change-Id: I2336e5261ef24114c5fee302ed95b4dfa1f67c11
Signed-off-by: Reka Norman 
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4452079
Tested-by: Reka Norman 
Commit-Queue: Reka Norman 
Reviewed-by: Julius Werner

futility: make flash --wp-status subcmd check HW status

2023-04-20T12:18:02+00:00

Check HW WP status as well as SW WP status by default.

A new `--ignore-hw` flag makes it possible to only check SW WP.

BUG=b:268574030
BRANCH=none
TEST=todo

Change-Id: I4a45499ceda52a1e00e7e33742b0bb48d235550b
Signed-off-by: Nikolai Artemiev 
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4413354
Commit-Queue: Edward O'Callaghan 
Reviewed-by: Edward O'Callaghan

Makefile: Respect standard CPPFLAGS

2023-04-19T02:35:29+00:00

The Makefile should respect the standard compilation setting
CPPFLAGS. For example, the cros-debug-add-NDEBUG function call in the
ebuild needs that to work.

BUG=none
TEST=USE=cros-debug emerge-corsola vboot_reference
TEST=USE=-cros-debug emerge-corsola vboot_reference
BRANCH=none

Change-Id: I9b3a404983b5db81fe401ef243de357c55f478b3
Signed-off-by: Yu-Ping Wu 
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4426377
Commit-Queue: Julius Werner 
Reviewed-by: Julius Werner

Makefile: Disable NDEBUG by default

2023-04-13T20:18:37+00:00

We decided in to enable NDEBUG by default because cryptolib would spam
the debug output [1]. Now that cryptolib is gone (CL:400903), we should
be able to turn it on by default, so that assert() calls will no longer
be no-ops.

The DISABLE_NDEBUG make variable is replaced with NDEBUG.

[1] https://codereview.chromium.org/3004001

BUG=none
TEST=make NDEBUG=1 futil -j
TEST=emerge-corsola vboot_reference
BRANCH=none

Change-Id: Ic97d85f0cc14c05a1084d02c6a150e4cc7d3393e
Signed-off-by: Yu-Ping Wu 
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4413341
Reviewed-by: Julius Werner 
Commit-Queue: Julius Werner

futility/: host/lib: Add flash chip info subcommand support

2023-04-13T10:05:41+00:00

The AP RO verification tooling requires a understanding of the
underlying flashchip information. Provision support in the
flash subcommand to report back this data from the flashrom
driver.

BUG=b:276981092
BRANCH=none
TEST=on Nissa ```
localhost ~ # futility flash --flash-i{nfo}
Warning: Setting BIOS Control at 0xdc from 0x8b to 0x89 failed.
New value is 0x8b.
Flash vendor: Winbond
Flash name: W25Q256JV_M
Flash vid-pid: 0xef00007019
Flash size: 0x02000000
```.

Cq-Depend: chromium:4401775, chromium:4401776
Change-Id: I58e818f06def4904693f61c6967d70b16c62fa37
Signed-off-by: Edward O'Callaghan 
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4402370
Auto-Submit: Edward O'Callaghan 
Tested-by: Edward O'Callaghan 
Commit-Queue: Jakub Czapiga 
Reviewed-by: Nikolai Artemiev

Fix build error when compiling without -DNDEBUG

2023-04-13T04:33:28+00:00

Currently the host lib is always built with "-DNDEBUG" (added by
Makefile). When NDEBUG is undefined, the symbols such as
TPM_TAG_RQU_COMMAND will be undeclared, leading to build error.

Since the assertion is for TPM1 only, add #ifndef guard for
TPM2_MODE.

BUG=none
TEST=make hostlib TPM2_MODE=0 DISABLE_NDEBUG=0
TEST=make hostlib TPM2_MODE=0 DISABLE_NDEBUG=1
TEST=make hostlib TPM2_MODE=1 DISABLE_NDEBUG=0
TEST=make hostlib TPM2_MODE=1 DISABLE_NDEBUG=1
BRANCH=none

Change-Id: Id2cb327e512140ed8fff04f5e54d3090d9e25dbe
Signed-off-by: Yu-Ping Wu 
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4418006
Reviewed-by: Julius Werner

futility: Allow printing manifest for EC only

2023-04-12T04:19:57+00:00

Currently `futility update --manifest` requires either -i/--image or
-a/--archive to be passed. There is no way to show the EC manifest
without also passing an AP image.

Extend the command by allowing `futility update --manifest -e FILE`.
Here are a few examples of valid commands:

* futility update --manifest --archive PATH
* futility update --manifest --image FILE
* futility update --manifest --image FILE --ec_image FILE
* futility update --manifest --ec_image FILE

BUG=none
TEST=make DISABLE_NDEBUG=1 futil -j
TEST=sudo emerge vboot_reference
TEST=futility update --manifest -e FILE
BRANCH=none

Change-Id: I267b90a3e5ff2891b519702558d173bb2e970052
Signed-off-by: Yu-Ping Wu 
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4413335
Reviewed-by: Hung-Te Lin 
Reviewed-by: Yidi Lin

firmware/2lib: Expose vb2_clear_recovery as vb2api

2023-04-12T03:23:51+00:00

For ChromeOS platform the recovery reason is cleared in
vb2api_kernel_phase2 which is probably not called by any non-ChromeOS
system. It results in the platform being stuck in recovery mode, e.g.
when RW firmware verification fails. Even if the RW partition is
flashed with correctly signed image, the persistent non-zero recovery
reason will prevent vboot from attempting the RW partition check.

Expose vb2_clear_recovery as vb2api to let non-ChromeOS coreboot
platform to clear the recovery reason when needed.

TEST=Clear the recovery reason in mainboard_final function right
before payload jump when RW partition is corrupted and RW partition is
valid. In case it is corrupted, the platform stays in recovery mode,
when valid the platform boots from RW partition. Tested on MSI PRO
Z690-A DDR4.

Change-Id: Ic2946150c404fc8e2d50d07d0746b2e42f7cbcde
Signed-off-by: Michał Żygowski 
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4414956
Reviewed-by: Julius Werner 
Commit-Queue: Julius Werner 
Tested-by: Julius Werner

sha256_armv8a_ce_a64.S: Reuse vb2_sha256_k[] in 2sha256.c

2023-04-12T01:06:15+00:00

Reuse round constants defined in 2sha256.c instead of having them twice.

BRANCH=none
BUG=none
TEST=boot to kernel

Change-Id: I6fe12b5d65a7c46078781cb1632eba5bca6797a0
Signed-off-by: Yidi Lin 
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4408854
Reviewed-by: Yu-Ping Wu 
Reviewed-by: Julius Werner