Issue #576 has been updated by Thierry Laurion.
Matt DeVillier wrote in #note-11: > Dan Ran wrote in #note-10: > > > If you walk me through the steps I can test on my T480. Just tell me what I > > need to do. > > > those patches are now merged, only > https://review.coreboot.org/c/coreboot/+/93324 remains. > > You can build coreboot for your board from current main branch, cherry-pick > the above commit, build/flash, and run the TPM fail tests to see if they > still fail. I can't have good results for t480 from my tpm-gpio-fail fork at https://github.com/tlaurion/tpm-gpio-fail/ Heads master https://github.com/linuxboot/heads/commit/ce8b359f88fca5814d60b9b467fc88fbabd90b8f (circleci build artifacts) were tested against both t480 and x280. - t480 results (can't trigger tPMG GPIO "reboot") https://github.com/linuxboot/heads/pull/2220#issuecomment-6252085881 - x280 was reported flawed on master https://github.com/linuxboot/heads/issues/2198#issuecomment-6303092079 and fixed on 26.09+patches at https://github.com/linuxboot/heads/pull/2220#issuecomment-6316086181 t480s and m900 still not tested with master https://github.com/linuxboot/heads/commit/ce8b359f88fca5814d60b9b467fc88fbabd90b8f nor https://github.com/linuxboot/heads/pull/2220 CircleCI build artifacts (green check on github commits either from master or in pull request). Somebody can give a hand, fork https://github.com/tlaurion/tpm-gpio-fail and help here with testing please? @matt https://github.com/linuxboot/heads/pull/2220 is 26.09 + all patches applied on top (look at patches/coreboot-26.09 there https://github.com/linuxboot/heads/pull/2220/changes ) Where tpm-gpio-fail is pinned from master and not changed to have proper pre/post tests. ---------------------------------------- Bug #576: GPIO locking is broken on Kaby Lake and possibly other platforms https://ticket.coreboot.org/issues/576#change-2441 * Author: Mate Kukri * Status: New * Priority: Normal * Target version: none * Start date: 2025-01-30 ---------------------------------------- Many supported Kaby Lake boards (and possibly newer platforms as well) are vulnerable to [TPM GPIO reset attacks](https://mkukri.xyz/2024/06/01/tpm-gpio-fail.html). Trying to fix this by marking the affected GPIOs as locked in gpio.h and even also selecting `SOC_INTEL_COMMON_BLOCK_SMM_LOCK_GPIO_PADS` does not work. This was discovered last year and briefly discussed on #coreboot, but it came up again on the Heads matrix group in relation to supporting the TPM on the in-progress ThinkPad T480 port. -- You have received this notification because you have either subscribed to it, or are involved in it. To change your notification preferences, please click here: https://ticket.coreboot.org/my/account _______________________________________________ coreboot mailing list -- [email protected] To unsubscribe send an email to [email protected]
