August 2017 - coreboot-gerrit - mail.coreboot.org

Change in coreboot[master]: WIP stoneyridge: Lock PSP region
by Julius Werner (Code Review) Sept. 1, 2017

Sept. 1, 2017

Julius Werner has posted comments on this change. ( https://review.coreboot.org/21308 ) Change subject: WIP stoneyridge: Lock PSP region ...................................................................... Patch Set 1: (1 comment) https://review.coreboot.org/#/c/21308/1//COMMIT_MSG Commit Message: https://review.coreboot.org/#/c/21308/1//COMMIT_MSG@12 PS1, Line 12: The call should move to bootblock. I just saw this flying by and don't know anything about the details here... but it sounds like this locks out PSP updates? Isn't that something that you might want to leave in romstage so that vboot systems would have a chance to get back in from an RW update? -- To view, visit https://review.coreboot.org/21308 To unsubscribe, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ic375033d9942045389a528182daca2cd5288b672 Gerrit-Change-Number: 21308 Gerrit-PatchSet: 1 Gerrit-Owner: Marc Jones <marc(a)marcjonesconsulting.com> Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Thu, 31 Aug 2017 23:53:38 +0000 Gerrit-HasComments: Yes

1 0

Change in coreboot[master]: WIP stoneyridge: Lock PSP region
by build bot (Jenkins) (Code Review) Sept. 1, 2017

Sept. 1, 2017

build bot (Jenkins) has posted comments on this change. ( https://review.coreboot.org/21308 ) Change subject: WIP stoneyridge: Lock PSP region ...................................................................... Patch Set 1: Verified+1 Build Successful https://qa.coreboot.org/job/coreboot-checkpatch/14936/ : SUCCESS https://qa.coreboot.org/job/coreboot-gerrit/59658/ : SUCCESS -- To view, visit https://review.coreboot.org/21308 To unsubscribe, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ic375033d9942045389a528182daca2cd5288b672 Gerrit-Change-Number: 21308 Gerrit-PatchSet: 1 Gerrit-Owner: Marc Jones <marc(a)marcjonesconsulting.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Thu, 31 Aug 2017 23:38:29 +0000 Gerrit-HasComments: No

1 0

Change in coreboot[master]: WIP stoneyridge: Lock PSP region
by Marc Jones (Code Review) Sept. 1, 2017

Sept. 1, 2017

Marc Jones has uploaded this change for review. ( https://review.coreboot.org/21308 Change subject: WIP stoneyridge: Lock PSP region ...................................................................... WIP stoneyridge: Lock PSP region This is a work in progress. The call to lock the PSP is currently in romstage for debugging via serial. The call should move to bootblock. Also, WP and SPI flash WP needs to be checked prior to locking the PSP region. Write Protect the SI_ALL FMAP area, which includes the AMD PSP, with the ROM_PROTECT in the SPI flash controller. SI_ALL@0x0 0xCB000 { UNUSED@0x00000 0x20000 AMD_FW@0x20000 0xAB000 } Change-Id: Ic375033d9942045389a528182daca2cd5288b672 Signed-off-by: Marc Jones <marcj303(a)gmail.com> --- M src/mainboard/google/kahlee/ec.c M src/soc/amd/stoneyridge/early_setup.c M src/soc/amd/stoneyridge/include/soc/southbridge.h 3 files changed, 82 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/08/21308/1 diff --git a/src/mainboard/google/kahlee/ec.c b/src/mainboard/google/kahlee/ec.c index 75ed1fa..6fe7226 100644 --- a/src/mainboard/google/kahlee/ec.c +++ b/src/mainboard/google/kahlee/ec.c @@ -72,4 +72,16 @@ ramstage_ec_init(); else early_ec_init(); + +/* + * Located here for testing. Move to bootblock_fch_early_init or other + * correct location before commiting. + */ +#ifdef __PRE_RAM__ + if (IS_ENABLED(CONFIG_CHROMEOS)) { + /* TODO: Check SPI WP setting before locking */ + if (sb_lock_psp()) + die("ERROR: Could Not WP PSP Region!\n"); + } +#endif } diff --git a/src/soc/amd/stoneyridge/early_setup.c b/src/soc/amd/stoneyridge/early_setup.c index 5166a7f..3618ba5 100644 --- a/src/soc/amd/stoneyridge/early_setup.c +++ b/src/soc/amd/stoneyridge/early_setup.c @@ -24,6 +24,7 @@ #include <soc/southbridge.h> #include <soc/pci_devs.h> #include <Fch/Fch.h> +#include <fmap.h> #include <cpu/x86/msr.h> #include <delay.h> @@ -342,6 +343,63 @@ pci_io_write_config16(dev, 0x6e, 0xffff); } +/* + * Set the write once SPI ROM Protect registers to protect the PSP. + * + * PCU_DEV, LPC_FUNC[5C,58,54,50] ROM Protect 3, 2, 1, 0 + * {RomBase, 000_0000_0000b} <= address[31:0] <= (({RomBase, 000_0000_0000b} + + * ((Range+1) << (RangeUnit ? 16 : 12) ) ) - 1). + */ +int sb_lock_psp(void) +{ + pci_devfn_t dev; + struct region r; + size_t r_offset, r_size; + u32 reg; + + dev = PCI_DEV(0, PCU_DEV, LPC_FUNC); + + /* Locate PSP area in the FMAP */ + if (fmap_locate_area("SI_ALL", &r) != 0 ) { + assert(0); + return -1; + } + + /* The offset from the bottom of the FLASH ROM. (4GB - ROMSIZE) */ + r_offset = 0xFFFFFFFF - CONFIG_ROM_SIZE + 1 + region_offset(&r); + r_size = region_sz(&r); + printk(BIOS_DEBUG, "r_offset: 0x%x r_size:0x%x\n", (u32)r_offset, (u32)r_size); + + reg = pci_io_read_config32(dev, LPC_ROM_PROTECT0); + + if (reg != 0) { + assert(0); + return -1; + } + + /* + * Determine the 4KB or 64 Region Unit size. + * The region MUST align with the unit size or it could write + * protect the next region. + */ + if (r_size <= (0x100 * 0x1000) && !(r_size % 0x1000)) { + reg |= (r_size / 0x1000); + reg |= LPC_ROM_PROTECT_UNIT_4KB; + } else if (r_size <= (0x100 * 0x10000) && !(r_size % 0x10000)) { + reg |= (r_size / 0x1000); + reg |= LPC_ROM_PROTECT_UNIT_64KB; + } else { + assert(0); /* region isn't aligned */ + return -1; + } + + reg |= r_offset & LPC_ROM_PROTECT_BASE_MASK; + reg |= LPC_ROM_PROTECT_WP; + pci_io_write_config32(dev, LPC_ROM_PROTECT0, reg); + printk(BIOS_DEBUG, "ROM PROTECT0: 0x%x\n", reg); //debug, remove + return 0; +} + void bootblock_fch_early_init(void) { sb_enable_rom(); diff --git a/src/soc/amd/stoneyridge/include/soc/southbridge.h b/src/soc/amd/stoneyridge/include/soc/southbridge.h index de481f0..ee71d14 100644 --- a/src/soc/amd/stoneyridge/include/soc/southbridge.h +++ b/src/soc/amd/stoneyridge/include/soc/southbridge.h @@ -120,6 +120,17 @@ #define LPC_WIDEIO1_ENABLE BIT(24) #define LPC_WIDEIO0_ENABLE BIT(2) +#define LPC_ROM_PROTECT0 0x50 +#define LPC_ROM_PROTECT1 0x54 +#define LPC_ROM_PROTECT2 0x58 +#define LPC_ROM_PROTECT3 0x5c +#define LPC_ROM_PROTECT_BASE_MASK 0xffffffff << 12 +#define LPC_ROM_PROTECT_WP BIT(10) +#define LPC_ROM_PROTECT_RP BIT(9) +#define LPC_ROM_PROTECT_UNIT_4KB 0 +#define LPC_ROM_PROTECT_UNIT_64KB BIT(8) +#define LPC_ROM_PROTECT_RANGE_MASK 0xff + #define LPC_WIDEIO_GENERIC_PORT 0x64 #define LPC_ALT_WIDEIO_RANGE_ENABLE 0x74 @@ -186,6 +197,7 @@ void sb_enable(device_t dev); void southbridge_final(void *chip_info); void southbridge_init(void *chip_info); +int sb_lock_psp(void); void sb_lpc_port80(void); void sb_lpc_decode(void); void sb_pci_port80(void); -- To view, visit https://review.coreboot.org/21308 To unsubscribe, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: newchange Gerrit-Change-Id: Ic375033d9942045389a528182daca2cd5288b672 Gerrit-Change-Number: 21308 Gerrit-PatchSet: 1 Gerrit-Owner: Marc Jones <marc(a)marcjonesconsulting.com>

1 0

Change in coreboot[master]: buildgcc: Fix up cross GCC building
by build bot (Jenkins) (Code Review) Sept. 1, 2017

Sept. 1, 2017

build bot (Jenkins) has posted comments on this change. ( https://review.coreboot.org/21307 ) Change subject: buildgcc: Fix up cross GCC building ...................................................................... Patch Set 1: Verified+1 Build Successful https://qa.coreboot.org/job/coreboot-checkpatch/14935/ : SUCCESS https://qa.coreboot.org/job/coreboot-toolchain/361/ : SUCCESS https://qa.coreboot.org/job/coreboot-gerrit/59657/ : SUCCESS -- To view, visit https://review.coreboot.org/21307 To unsubscribe, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Icf6d3b7de4b7999b8214489f28997964c490d1e9 Gerrit-Change-Number: 21307 Gerrit-PatchSet: 1 Gerrit-Owner: Nico Huber <nico.h(a)gmx.de> Gerrit-Reviewer: Martin Roth <martinroth(a)google.com> Gerrit-Reviewer: Nico Huber <nico.h(a)gmx.de> Gerrit-Reviewer: Patrick Georgi <pgeorgi(a)google.com> Gerrit-Reviewer: Paul Menzel <paulepanter(a)users.sourceforge.net> Gerrit-Reviewer: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Thu, 31 Aug 2017 22:41:11 +0000 Gerrit-HasComments: No

1 0

Change in coreboot[master]: buildgcc: Fix up cross GCC building
by Nico Huber (Code Review) Aug. 31, 2017

Aug. 31, 2017

Nico Huber has uploaded this change for review. ( https://review.coreboot.org/21307 Change subject: buildgcc: Fix up cross GCC building ...................................................................... buildgcc: Fix up cross GCC building Add a missing line-break escape and, rather cosmetic, guard execution of $CXX which we allow but don't force to be set. Change-Id: Icf6d3b7de4b7999b8214489f28997964c490d1e9 Signed-off-by: Nico Huber <nico.h(a)gmx.de> --- M util/crossgcc/buildgcc 1 file changed, 2 insertions(+), 2 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/07/21307/1 diff --git a/util/crossgcc/buildgcc b/util/crossgcc/buildgcc index dcfb9a6..07aaf68 100755 --- a/util/crossgcc/buildgcc +++ b/util/crossgcc/buildgcc @@ -659,7 +659,7 @@ # Work around crazy code generator in GCC that confuses CLANG. $CC --version | grep clang >/dev/null 2>&1 && \ CLANGFLAGS="-fbracket-depth=1024" - $CXX --version | grep clang >/dev/null 2>&1 && \ + [ -n "$CXX" ] && $CXX --version | grep clang >/dev/null 2>&1 && \ CLANGCXXFLAGS="-fbracket-depth=1024" # GCC does not honor HOSTCFLAGS at all. CFLAGS are used for @@ -670,7 +670,7 @@ # Also set the CXX version of the flags because GCC is now compiled # using C++. CC="$(hostcc target)" CXX="$(hostcxx target)" \ - CFLAGS_FOR_TARGET="-O2 -Dinhibit_libc" + CFLAGS_FOR_TARGET="-O2 -Dinhibit_libc" \ CFLAGS="$HOSTCFLAGS $CLANGFLAGS" \ CFLAGS_FOR_BUILD="$HOSTCFLAGS $CLANGFLAGS" \ CXXFLAGS="$HOSTCFLAGS $CLANGCXXFLAGS" \ -- To view, visit https://review.coreboot.org/21307 To unsubscribe, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: newchange Gerrit-Change-Id: Icf6d3b7de4b7999b8214489f28997964c490d1e9 Gerrit-Change-Number: 21307 Gerrit-PatchSet: 1 Gerrit-Owner: Nico Huber <nico.h(a)gmx.de>

1 0

Change in coreboot[master]: google/gru: Support Nefario rev0
by build bot (Jenkins) (Code Review) Aug. 31, 2017

Aug. 31, 2017

build bot (Jenkins) has posted comments on this change. ( https://review.coreboot.org/21176 ) Change subject: google/gru: Support Nefario rev0 ...................................................................... Patch Set 5: Verified+1 Build Successful https://qa.coreboot.org/job/coreboot-checkpatch/14933/ : SUCCESS https://qa.coreboot.org/job/coreboot-gerrit/59655/ : SUCCESS -- To view, visit https://review.coreboot.org/21176 To unsubscribe, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I350db2c080f2e41ae56413f5f895557978ef0ba8 Gerrit-Change-Number: 21176 Gerrit-PatchSet: 5 Gerrit-Owner: Philip Chen <philipchen(a)google.com> Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: Open Source Software for Rockchip SoCs(moved to https://github.com/rockchip-linux/) Gerrit-Reviewer: Paul Menzel <paulepanter(a)users.sourceforge.net> Gerrit-Reviewer: Philip Chen <philipchen(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Thu, 31 Aug 2017 18:56:02 +0000 Gerrit-HasComments: No

1 0

Change in coreboot[master]: Makefile: Include Makefile from site-local
by Martin Roth (Code Review) Aug. 31, 2017

Aug. 31, 2017

Martin Roth has posted comments on this change. ( https://review.coreboot.org/21303 ) Change subject: Makefile: Include Makefile from site-local ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://review.coreboot.org/21303 To unsubscribe, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I62d1562687ffe18546add80fdde1196700a65236 Gerrit-Change-Number: 21303 Gerrit-PatchSet: 2 Gerrit-Owner: Naresh Solanki <naresh.solanki(a)intel.com> Gerrit-Reviewer: Martin Roth <martinroth(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Thu, 31 Aug 2017 18:27:23 +0000 Gerrit-HasComments: No

1 0

Change in coreboot[master]: google/gru: Support Nefario rev0
by build bot (Jenkins) (Code Review) Aug. 31, 2017

Aug. 31, 2017

build bot (Jenkins) has posted comments on this change. ( https://review.coreboot.org/21176 ) Change subject: google/gru: Support Nefario rev0 ...................................................................... Patch Set 4: Verified-1 Build Failed https://qa.coreboot.org/job/coreboot-gerrit/59649/ : FAILURE https://qa.coreboot.org/job/coreboot-checkpatch/14927/ : SUCCESS -- To view, visit https://review.coreboot.org/21176 To unsubscribe, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I350db2c080f2e41ae56413f5f895557978ef0ba8 Gerrit-Change-Number: 21176 Gerrit-PatchSet: 4 Gerrit-Owner: Philip Chen <philipchen(a)google.com> Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: Open Source Software for Rockchip SoCs(moved to https://github.com/rockchip-linux/) Gerrit-Reviewer: Paul Menzel <paulepanter(a)users.sourceforge.net> Gerrit-Reviewer: Philip Chen <philipchen(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Thu, 31 Aug 2017 18:12:12 +0000 Gerrit-HasComments: No

1 0

Change in coreboot[master]: Makefile: Include Makefile from site-local
by build bot (Jenkins) (Code Review) Aug. 31, 2017

Aug. 31, 2017

build bot (Jenkins) has posted comments on this change. ( https://review.coreboot.org/21303 ) Change subject: Makefile: Include Makefile from site-local ...................................................................... Patch Set 2: Build Successful https://qa.coreboot.org/job/coreboot-gerrit/59648/ : SUCCESS -- To view, visit https://review.coreboot.org/21303 To unsubscribe, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I62d1562687ffe18546add80fdde1196700a65236 Gerrit-Change-Number: 21303 Gerrit-PatchSet: 2 Gerrit-Owner: Naresh Solanki <naresh.solanki(a)intel.com> Gerrit-Reviewer: Martin Roth <martinroth(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Thu, 31 Aug 2017 17:55:25 +0000 Gerrit-HasComments: No

1 0

Change in coreboot[master]: Makefile: Include Makefile from site-local
by Naresh Solanki (Code Review) Aug. 31, 2017

Aug. 31, 2017

Hello build bot (Jenkins), Martin Roth, I'd like you to reexamine a change. Please visit https://review.coreboot.org/21303 to look at the new patch set (#2). Change subject: Makefile: Include Makefile from site-local ...................................................................... Makefile: Include Makefile from site-local Include Makefile from site-local even in absence of DOTCONFIG. This will allow execution of Makefile option from site-local in absence of DOTCONFIG as well. Change-Id: I62d1562687ffe18546add80fdde1196700a65236 Signed-off-by: Naresh G Solanki <naresh.solanki(a)intel.com> --- M Makefile 1 file changed, 1 insertion(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/03/21303/2 -- To view, visit https://review.coreboot.org/21303 To unsubscribe, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-MessageType: newpatchset Gerrit-Change-Id: I62d1562687ffe18546add80fdde1196700a65236 Gerrit-Change-Number: 21303 Gerrit-PatchSet: 2 Gerrit-Owner: Naresh Solanki <naresh.solanki(a)intel.com> Gerrit-Reviewer: Martin Roth <martinroth(a)google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>

1 0