delta/coreboot/vboot.git, branch stabilize-15364.B

scripts/image_signing/make_dev_ssd.sh: Replace flashrom call

2023-02-24T09:11:05+00:00

Just use futility directly.

BUG=b:260531154
TEST=```
localhost ~ # futility gbb -g --flash --rootkey=/tmp/rkey >/dev/null 2>&1
localhost ~ # od /tmp/rkey | head -130 | md5sum | sed 's/ .*$//'
a13642246ef93daaf75bd791446fec9b
```

Change-Id: I1aa3b52f568a5e78255b52a15d68258cc9d9aa44
Signed-off-by: Edward O'Callaghan 
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4269750
Reviewed-by: Yu-Ping Wu 
Commit-Queue: Yu-Ping Wu 
Tested-by: Edward O'Callaghan 
Reviewed-by: Sam McNally 
Auto-Submit: Edward O'Callaghan

futility/cmd_gbb_utility.c: Allow OR'ing new GBB flags

2023-02-23T07:23:36+00:00

It maybe the case that the caller wishes to not clobber
the current flags set and merely just OR on the new bits.

BUG=b:270074866
TEST=```
 # futility gbb --flash --get --flags
 # futility gbb --flash --set --flags=(+|-)0x1
 # futility gbb --flash --get --flags
as expected.
```

Change-Id: Ibd56dff986d2075b7b220c531e66b224d488b6e6
Signed-off-by: Edward O'Callaghan 
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4273505
Auto-Submit: Edward O'Callaghan 
Commit-Queue: Yu-Ping Wu 
Commit-Queue: Edward O'Callaghan 
Reviewed-by: Sam McNally 
Reviewed-by: Yu-Ping Wu 
Tested-by: Edward O'Callaghan

Avoid build failures with dumpRSAPublicKey on recent distros

2023-02-16T17:52:09+00:00

Emit a warning and continue when OpenSSL is newer than expected. The
chroot still uses an older version.

This was broken by:

   0ca7a9e4 ("firmware: host: futility: Add CBFS metadata hash support")

BUG=b:245993083, b:246328810, b:197114807
BRANCH=none
TEST=make -C ~/cosarm/src/platform/vboot_reference/ USE_FLASHROM=0
See that the errors become warnings and the build completes

Change-Id: Id4e25e4ebad1d9ae1f6ee5425b3e6fe3cbd5d5e5
Signed-off-by: Simon Glass 
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4241424
Reviewed-by: Yu-Ping Wu

futility: gbb: Avoid unnecessary search of FMAP

2023-02-16T12:16:13+00:00

For commands such as `futility gbb --set --flags=0x140`, futility first
reads the GBB section from the flash, modifies the section, and then
writes back the section to the flash. The write, however, requires
another search of the FMAP section, in order to locate the GBB section
in the flash.

This unnecessary search can be avoided by reading the FMAP section
together with the GBB section. The FMAP data will be stored in the image
buffer, so that the FMAP layout can be retrieved directly from the
buffer for subsequent writes.

This will also prevent the misleading warnings from showing up:

 Failed to read fmap from buffer.
 WARNING: flashrom_write_image: could not read fmap from image, r=1,
 falling back to read from rom

BUG=b:260531154
TEST=emerge-corsola vboot_reference
TEST=make runtests
TEST=No warnings and errors were shown with
     `futility gbb --set --flash --flags=0x140`
BRANCH=none

Change-Id: I50029ae5d9c5ecb347f47e980e7c3b772ecc0f18
Signed-off-by: Yu-Ping Wu 
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4251504
Reviewed-by: Hung-Te Lin

futility: flashrom_drv: Support partial read for multiple regions

2023-02-16T12:16:11+00:00

Similar to CL:3490388, support flashrom read for multiple regions.

BUG=b:260531154
TEST=emerge-corsola vboot_reference
BRANCH=none

Change-Id: I1f75832f882004e879bc299be6862db089c2b71d
Signed-off-by: Yu-Ping Wu 
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4251503
Reviewed-by: Hung-Te Lin

host/lib/flashrom_drv.c: Move flag to avoid locked ME issue

2023-02-16T10:20:52+00:00

Older Intel DUT's have a ME in "locked" mode in the descriptor
and while the write_flash() attempts to write back to flash
to a specific region it needs to read the FMAP to obtain the
region name. This read overlaps with the "locked" region and
thus the following is observed in logs:

```
FREG2: Management Engine region (0x00001000-0x001fffff) is locked.
[..]
read_flash: cannot read inside Management Engine region (0x001000..0x1fffff).
```

BUG=b:269199980
TEST=builds.

Change-Id: If7bebf28cd4d34cc4074700184233c83edbd2409
Signed-off-by: Edward O'Callaghan 
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4248344
Auto-Submit: Edward O'Callaghan 
Reviewed-by: Sam McNally 
Reviewed-by: Hung-Te Lin 
Tested-by: Edward O'Callaghan 
Commit-Queue: Edward O'Callaghan

{g,s}et_gbb_flags.sh: Fix removal notice message

2023-02-16T09:14:24+00:00

Fix the futility command in the removal notice message, by adding the
missing `--flash` option.

BUG=b:260531154
TEST=Ran set_gbb_flags.sh
BRANCH=none

Change-Id: Ic1846929661a47c40b65e67ea76f776493ee2d9c
Signed-off-by: Yu-Ping Wu 
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4251505
Reviewed-by: Edward O'Callaghan 
Commit-Queue: Matthew Blecker 
Reviewed-by: Matthew Blecker 
Reviewed-by: Alexandru Stan

vboot_reference-sys: Use --blocklist-type when invoking bindgen

2023-02-16T01:59:39+00:00

Previous versions of bindgen used --blacklist-type, newer versions
of bindgen use --blocklist-type. This change updates our build
script to use the new spelling.

BRANCH=none
BUG=b:264938287
TEST=emerge-amd64-generic dev-rust/vboot_reference-sys

Change-Id: I15bf4591177af89693d9f02fd3ec2a3c27c92cbb
Signed-off-by: Bob Haarman 
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4250779
Reviewed-by: Allen Webb

vboot_reference-sys: Fix needless-borrow lints

2023-02-16T01:59:26+00:00

Pre-submit hooks pointed out several unnecessary borrows in the build
script. This fixes those.

BRANCH=none
BUG=None
TEST=cq

Change-Id: I92987004db3573084fa91db3b72f09b7b7327cfb
Signed-off-by: Bob Haarman 
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4250778
Reviewed-by: Allen Webb

2sha256_arm: Fix data abort issue

2023-02-14T16:48:40+00:00

Fix the following CPU exception when enabling ARMV8_CRYPTO_EXT.

[DEBUG]  exception _sync_sp_el0
[DEBUG]  ELR = 0x000000000025f390         ESR = 0x96000010
[DEBUG]  FAR = 0x000000000c000000        SPSR = 0x2000000c
[DEBUG]  X00 = 0x000000000026cf20         X01 = 0x000000000bffffe0
[DEBUG]  X02 = 0x00000000ffd042de         X03 = 0xffffffffffffffff
[DEBUG]  X04 = 0x000000000026cf88         X05 = 0x0000000000054ff8
[DEBUG]  X06 = 0x0000000000000002         X07 = 0x000000000000000a
[DEBUG]  X08 = 0x000000000025f5f0         X09 = 0x000000000026cf30
[DEBUG]  X10 = 0x000000000010b4ee         X11 = 0x00000000000001fc
[DEBUG]  X12 = 0x0000000000000080         X13 = 0x0000000000125110
[DEBUG]  X14 = 0x0000000000124f10         X15 = 0x0000000000125310
[DEBUG]  X16 = 0x0000000000267580         X17 = 0x749ffa8d9d5f02ca
[DEBUG]  X18 = 0x0000000000125110         X19 = 0x0000000000000000
[DEBUG]  X20 = 0x000000000026cf20         X21 = 0x000000000010b760
[DEBUG]  X22 = 0x000000000026cf48         X23 = 0x0000000000000000
[DEBUG]  X24 = 0x0000000000000000         X25 = 0x00000000000a3800
[DEBUG]  X26 = 0x000000000026c970         X27 = 0x000000000026c802
[DEBUG]  X28 = 0x0000000000000000         X29 = 0x0000000000000000
[DEBUG]  X30 = 0x000000000025f1e0          SP = 0x000000000010b650

The issue happens when the buffer size processed by
`vb2ex_hwcrypto_digest_extend` is equal to VB2_SHA256_BLOCK_SIZE.
`vb2_sha256_transform_hwcrypto` is called twice in
`vb2ex_hwcrypto_digest_extend`. The first call processes the whole
buffer. The second call still processes the buffer even if
`remaining_blocks` is equal to 0. This causes `block_nb`(see X02)
underflow in the assembly code. Then ld1 instruction accesses an
unexpected memory address(see X01) and raises CPU exception.

Fix the issue by checking `block_nb` value before calling to
`sha256_ce_transform`.

BRANCH=corsola
BUG=b:263514393
TEST=flash image-geralt*.bin and no CPU exception raised

Change-Id: I9b74d60413b3cc571950e15c0d2b901bc4063385
Signed-off-by: Yidi Lin 
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/4242678
Reviewed-by: Yu-Ping Wu