Hello build bot (Jenkins),
I'd like you to reexamine a change. Please visit
https://review.coreboot.org/21327
to look at the new patch set (#3).
Change subject: sb/intel/bd82x6x: Revise flash ROM lockdown options
......................................................................
sb/intel/bd82x6x: Revise flash ROM lockdown options
The original options were named and described under the false assumption
that the chipset lockdown would only be executed during S3 resume. Fix
that.
Change-Id: I435a3b63dd294aa766b1eccf1aa80a7c47e55c95
Signed-off-by: Nico Huber <nico.h(a)gmx.de>
---
M src/southbridge/intel/bd82x6x/Kconfig
M src/southbridge/intel/bd82x6x/finalize.c
2 files changed, 29 insertions(+), 20 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/27/21327/3
--
To view, visit https://review.coreboot.org/21327
To unsubscribe, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I435a3b63dd294aa766b1eccf1aa80a7c47e55c95
Gerrit-Change-Number: 21327
Gerrit-PatchSet: 3
Gerrit-Owner: Nico Huber <nico.h(a)gmx.de>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Hello build bot (Jenkins),
I'd like you to reexamine a change. Please visit
https://review.coreboot.org/21327
to look at the new patch set (#2).
Change subject: sb/intel/bd82x6x: Revise flash ROM lockdown options
......................................................................
sb/intel/bd82x6x: Revise flash ROM lockdown options
The original options were named and described under the false assumption
that the chipset lockdown would only be executed during S3 resume. Fix
that.
Change-Id: I435a3b63dd294aa766b1eccf1aa80a7c47e55c95
Signed-off-by: Nico Huber <nico.h(a)gmx.de>
---
M src/southbridge/intel/bd82x6x/Kconfig
M src/southbridge/intel/bd82x6x/finalize.c
2 files changed, 33 insertions(+), 20 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/27/21327/2
--
To view, visit https://review.coreboot.org/21327
To unsubscribe, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I435a3b63dd294aa766b1eccf1aa80a7c47e55c95
Gerrit-Change-Number: 21327
Gerrit-PatchSet: 2
Gerrit-Owner: Nico Huber <nico.h(a)gmx.de>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Nico Huber has uploaded this change for review. ( https://review.coreboot.org/21327
Change subject: sb/intel/bd82x6x: Revise flash ROM lockdown options
......................................................................
sb/intel/bd82x6x: Revise flash ROM lockdown options
The original options were named and described under the false assumption
that the chipset lockdown would only be executed during S3 resume. Fix
that.
Change-Id: I435a3b63dd294aa766b1eccf1aa80a7c47e55c95
Signed-off-by: Nico Huber <nico.h(a)gmx.de>
---
M src/southbridge/intel/bd82x6x/Kconfig
M src/southbridge/intel/bd82x6x/finalize.c
2 files changed, 33 insertions(+), 20 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/27/21327/1
diff --git a/src/southbridge/intel/bd82x6x/Kconfig b/src/southbridge/intel/bd82x6x/Kconfig
index 9eb3111..fcaa139 100644
--- a/src/southbridge/intel/bd82x6x/Kconfig
+++ b/src/southbridge/intel/bd82x6x/Kconfig
@@ -75,29 +75,41 @@
if SOUTHBRIDGE_INTEL_BD82X6X || SOUTHBRIDGE_INTEL_C216 || SOUTHBRIDGE_INTEL_IBEXPEAK
choice
- prompt "Flash ROM locking on S3 resume"
- default LOCK_SPI_ON_RESUME_NONE
+ prompt "Flash ROM locking during chipset lockdown"
+ default LOCK_SPI_FLASH_NONE
-config LOCK_SPI_ON_RESUME_NONE
- bool "Don't lock ROM sections on S3 resume"
+config LOCK_SPI_FLASH_NONE
+ bool "Don't lock ROM sections"
-config LOCK_SPI_ON_RESUME_RO
- bool "Lock all flash ROM sections on S3 resume"
+config LOCK_SPI_FLASH_RO
+ bool "Lock all flash ROM sections"
help
- If the flash ROM shall be protected against write accesses from the
- operating system (OS), the locking procedure has to be repeated after
- each resume from S3. Select this if you never want to update the flash
- ROM from within your OS. Notice: Even with this option, the write lock
- has still to be enabled on the normal boot path (e.g. by the payload).
+ Select this if you want to write-protect the whole firmware flash
+ chip. The locking will take place during the chipset lockdown, which
+ is either triggered by coreboot (when INTEL_CHIPSET_LOCKDOWN is set)
+ or has to be triggered later (e.g. by the payload or the OS).
-config LOCK_SPI_ON_RESUME_NO_ACCESS
- bool "Lock and disable reads all flash ROM sections on S3 resume"
+ NOTE: If you trigger the chipset lockdown unconditionally,
+ you won't be able to write to the flash chip using the
+ internal programmer any more.
+
+#' fix syntax highlighting
+
+config LOCK_SPI_FLASH_NO_ACCESS
+ bool "Lock and disable reads for all flash ROM sections"
help
- If the flash ROM shall be protected against all accesses from the
- operating system (OS), the locking procedure has to be repeated after
- each resume from S3. Select this if you never want to update the flash
- ROM from within your OS. Notice: Even with this option, the lock
- has still to be enabled on the normal boot path (e.g. by the payload).
+ Select this if you want to protect the firmware flash against all
+ further accesses (with the exception of the memory mapped BIOS re-
+ gion which is always readable). The locking will take place during
+ the chipset lockdown, which is either triggered by coreboot (when
+ INTEL_CHIPSET_LOCKDOWN is set) or has to be triggered later (e.g.
+ by the payload or the OS).
+
+ NOTE: If you trigger the chipset lockdown unconditionally,
+ you won't be able to write to the flash chip using the
+ internal programmer any more.
+
+#' fix syntax highlighting
endchoice
diff --git a/src/southbridge/intel/bd82x6x/finalize.c b/src/southbridge/intel/bd82x6x/finalize.c
index a9cfa38..fe28af0 100644
--- a/src/southbridge/intel/bd82x6x/finalize.c
+++ b/src/southbridge/intel/bd82x6x/finalize.c
@@ -25,12 +25,13 @@
u16 tco1_cnt;
u16 pmbase;
- if (CONFIG_LOCK_SPI_ON_RESUME_RO || CONFIG_LOCK_SPI_ON_RESUME_NO_ACCESS) {
+ if (IS_ENABLED(CONFIG_LOCK_SPI_FLASH_RO) ||
+ IS_ENABLED(CONFIG_LOCK_SPI_FLASH_NO_ACCESS)) {
/* Copy flash regions from FREG0-4 to PR0-4
and enable write protection bit31 */
int i;
u32 lockmask = (1 << 31);
- if (CONFIG_LOCK_SPI_ON_RESUME_NO_ACCESS)
+ if (IS_ENABLED(CONFIG_LOCK_SPI_FLASH_NO_ACCESS))
lockmask |= (1 << 15);
for (i = 0; i < 20; i += 4)
RCBA32(0x3874 + i) = RCBA32(0x3854 + i) | lockmask;
--
To view, visit https://review.coreboot.org/21327
To unsubscribe, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: I435a3b63dd294aa766b1eccf1aa80a7c47e55c95
Gerrit-Change-Number: 21327
Gerrit-PatchSet: 1
Gerrit-Owner: Nico Huber <nico.h(a)gmx.de>
Nico Huber has uploaded this change for review. ( https://review.coreboot.org/21326
Change subject: nb/intel/common: Write MRC cache at exit of BS_DEV_INIT
......................................................................
nb/intel/common: Write MRC cache at exit of BS_DEV_INIT
We set the SPI lockdown in BS_POST_DEVICE (dev_finalize()) on many plat-
forms now. The SPI controller is initialized at start of BS_DEV_INIT
(dev_initialize()).
The SPI lockdown usually shouldn't be a problem but the SPI driver imple-
mentation lacks full support for the locked interface. Also, some options
exist to lock all flash regions read-only until the next reboot.
Change-Id: Ifda826ae2bb28adcce8dda8e2bb16dc38fe0fe9e
Signed-off-by: Nico Huber <nico.h(a)gmx.de>
---
M src/northbridge/intel/common/mrc_cache.c
1 file changed, 6 insertions(+), 1 deletion(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/26/21326/1
diff --git a/src/northbridge/intel/common/mrc_cache.c b/src/northbridge/intel/common/mrc_cache.c
index 2fc8d96..f692282 100644
--- a/src/northbridge/intel/common/mrc_cache.c
+++ b/src/northbridge/intel/common/mrc_cache.c
@@ -19,6 +19,7 @@
#include <console/console.h>
#include <cbfs.h>
#include <fmap.h>
+#include <arch/acpi.h>
#include <ip_checksum.h>
#include <device/device.h>
#include <cbmem.h>
@@ -162,6 +163,9 @@
int ret;
struct spi_flash flash;
+ if (acpi_is_wakeup_s3())
+ return;
+
if (!current) {
printk(BIOS_ERR, "No MRC cache in cbmem. Can't update flash.\n");
return;
@@ -231,7 +235,8 @@
printk(BIOS_DEBUG, "Successfully wrote MRC cache\n");
}
-BOOT_STATE_INIT_ENTRY(BS_WRITE_TABLES, BS_ON_ENTRY, update_mrc_cache, NULL);
+/* Do it before chipset is locked during BS_POST_DEVICE. */
+BOOT_STATE_INIT_ENTRY(BS_DEV_INIT, BS_ON_EXIT, update_mrc_cache, NULL);
struct mrc_data_container *find_current_mrc_cache(void)
{
--
To view, visit https://review.coreboot.org/21326
To unsubscribe, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: Ifda826ae2bb28adcce8dda8e2bb16dc38fe0fe9e
Gerrit-Change-Number: 21326
Gerrit-PatchSet: 1
Gerrit-Owner: Nico Huber <nico.h(a)gmx.de>