Hello Aaron Durbin, Frans Hendriks, Philipp Deppenwiese,
I'd like you to do a code review. Please visit
https://review.coreboot.org/c/coreboot/+/32716
to review the following change.
Change subject: vboot: Turn vboot_logic_executed() into a static inline
......................................................................
vboot: Turn vboot_logic_executed() into a static inline
This patch moves vboot_logic_executed() (and its dependencies) into a
header and turns it into a static inline function. The function is used
to guard larger amounts of code in several places, so this should allow
us to safe some more space through compile-time elimination (and also
makes it easier to avoid undefined reference issues in some cases).
Change-Id: I193f608882cbfe07dc91ee90d02fafbd67a3c324
Signed-off-by: Julius Werner <jwerner(a)chromium.org>
---
M src/security/vboot/misc.h
M src/security/vboot/vboot_loader.c
2 files changed, 58 insertions(+), 54 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/16/32716/1
diff --git a/src/security/vboot/misc.h b/src/security/vboot/misc.h
index b4fae19..2a0523d 100644
--- a/src/security/vboot/misc.h
+++ b/src/security/vboot/misc.h
@@ -16,6 +16,8 @@
#ifndef __VBOOT_MISC_H__
#define __VBOOT_MISC_H__
+#include <assert.h>
+#include <arch/early_variables.h>
#include <security/vboot/vboot_common.h>
struct vb2_context;
@@ -66,13 +68,63 @@
void vboot_fill_handoff(void);
/*
- * Source: security/vboot/vboot_loader.c
- */
-int vboot_logic_executed(void);
-
-/*
* Source: security/vboot/bootmode.c
*/
void vboot_save_recovery_reason_vbnv(void);
+/*
+ * The stage loading code is compiled and entered from multiple stages. The
+ * helper functions below attempt to provide more clarity on when certain
+ * code should be called. They are implemented inline for better compile-time
+ * code elimination.
+ */
+
+static inline int verification_should_run(void)
+{
+ if (CONFIG(VBOOT_SEPARATE_VERSTAGE))
+ return ENV_VERSTAGE;
+ else if (CONFIG(VBOOT_STARTS_IN_ROMSTAGE))
+ return ENV_ROMSTAGE;
+ else if (CONFIG(VBOOT_STARTS_IN_BOOTBLOCK))
+ return ENV_BOOTBLOCK;
+ else
+ dead_code();
+}
+
+static inline int verstage_should_load(void)
+{
+ if (CONFIG(VBOOT_SEPARATE_VERSTAGE))
+ return ENV_BOOTBLOCK;
+ else
+ return 0;
+}
+
+/* Only for use by functions in this header, do not access directly! */
+extern int vboot_executed;
+
+static inline int vboot_logic_executed(void)
+{
+ /* If we are in the stage that runs verification, or in the stage that
+ both loads the verstage and is returned to from it afterwards, we
+ need to check a global to see if verfication has run. */
+ if (verification_should_run() ||
+ (verstage_should_load() && CONFIG(VBOOT_RETURN_FROM_VERSTAGE)))
+ return car_get_var(vboot_executed);
+
+ if (CONFIG(VBOOT_STARTS_IN_BOOTBLOCK)) {
+ /* All other stages are "after the bootblock" */
+ return !ENV_BOOTBLOCK;
+ } else if (CONFIG(VBOOT_STARTS_IN_ROMSTAGE)) {
+ /* Post-RAM stages are "after the romstage" */
+#ifdef __PRE_RAM__
+ return 0;
+#else
+ return 1;
+#endif
+ } else {
+ dead_code();
+ }
+}
+
+
#endif /* __VBOOT_MISC_H__ */
diff --git a/src/security/vboot/vboot_loader.c b/src/security/vboot/vboot_loader.c
index 3bbb3da..1350307 100644
--- a/src/security/vboot/vboot_loader.c
+++ b/src/security/vboot/vboot_loader.c
@@ -36,55 +36,7 @@
CONFIG(VBOOT_SEPARATE_VERSTAGE),
"return from verstage only makes sense for separate verstages");
-/* The stage loading code is compiled and entered from multiple stages. The
- * helper functions below attempt to provide more clarity on when certain
- * code should be called. */
-
-static int verification_should_run(void)
-{
- if (CONFIG(VBOOT_SEPARATE_VERSTAGE))
- return ENV_VERSTAGE;
- else if (CONFIG(VBOOT_STARTS_IN_ROMSTAGE))
- return ENV_ROMSTAGE;
- else if (CONFIG(VBOOT_STARTS_IN_BOOTBLOCK))
- return ENV_BOOTBLOCK;
- else
- die("impossible!");
-}
-
-static int verstage_should_load(void)
-{
- if (CONFIG(VBOOT_SEPARATE_VERSTAGE))
- return ENV_BOOTBLOCK;
- else
- return 0;
-}
-
-static int vboot_executed CAR_GLOBAL;
-
-int vboot_logic_executed(void)
-{
- /* If we are in the stage that runs verification, or in the stage that
- both loads the verstage and is returned to from it afterwards, we
- need to check a global to see if verfication has run. */
- if (verification_should_run() ||
- (verstage_should_load() && CONFIG(VBOOT_RETURN_FROM_VERSTAGE)))
- return car_get_var(vboot_executed);
-
- if (CONFIG(VBOOT_STARTS_IN_BOOTBLOCK)) {
- /* All other stages are "after the bootblock" */
- return !ENV_BOOTBLOCK;
- } else if (CONFIG(VBOOT_STARTS_IN_ROMSTAGE)) {
- /* Post-RAM stages are "after the romstage" */
-#ifdef __PRE_RAM__
- return 0;
-#else
- return 1;
-#endif
- } else {
- die("impossible!");
- }
-}
+int vboot_executed CAR_GLOBAL;
static void vboot_prepare(void)
{
--
To view, visit https://review.coreboot.org/c/coreboot/+/32716
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I193f608882cbfe07dc91ee90d02fafbd67a3c324
Gerrit-Change-Number: 32716
Gerrit-PatchSet: 1
Gerrit-Owner: Julius Werner <jwerner(a)chromium.org>
Gerrit-Reviewer: Aaron Durbin <adurbin(a)chromium.org>
Gerrit-Reviewer: Frans Hendriks <fhendriks(a)eltan.com>
Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org>
Gerrit-Reviewer: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com>
Gerrit-MessageType: newchange
Felix Singer has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/31086
Change subject: payloads/ipxe: Enable HTTPS support
......................................................................
payloads/ipxe: Enable HTTPS support
HTTPS needs a newer iPXE version than 2017.3,
because it doesn't work with this release.
Tested under master branch.
Change-Id: Ia25d4ce9260fa8c00fdea0e19f5e927559371af0
Signed-off-by: Felix Singer <migy(a)darmstadt.ccc.de>
---
M payloads/external/iPXE/Makefile
1 file changed, 1 insertion(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/86/31086/1
diff --git a/payloads/external/iPXE/Makefile b/payloads/external/iPXE/Makefile
index a8b1245..05b6f4dd 100644
--- a/payloads/external/iPXE/Makefile
+++ b/payloads/external/iPXE/Makefile
@@ -54,6 +54,7 @@
sed 's|#define\s*COMCONSOLE.*|#define COMCONSOLE $(IPXE_UART)|' "$(project_dir)/src/config/serial.h" > "$(project_dir)/src/config/serial.h.tmp"
sed 's|#define\s*COMSPEED.*|#define COMSPEED $(CONFIG_TTYS0_BAUD)|' "$(project_dir)/src/config/serial.h.tmp" > "$(project_dir)/src/config/serial.h"
endif
+ sed -ie 's|.*DOWNLOAD_PROTO_HTTPS|#define DOWNLOAD_PROTO_HTTPS|g' "$(project_dir)/src/config/general.h"
build: config
echo " MAKE $(project_name) $(TAG-y)"
--
To view, visit https://review.coreboot.org/c/coreboot/+/31086
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ia25d4ce9260fa8c00fdea0e19f5e927559371af0
Gerrit-Change-Number: 31086
Gerrit-PatchSet: 1
Gerrit-Owner: Felix Singer <migy(a)darmstadt.ccc.de>
Gerrit-MessageType: newchange
Patrick Rudolph has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/32705
Change subject: security/lockdown: Write-protect WP_RO
......................................................................
security/lockdown: Write-protect WP_RO
Add another choice to boot media protection and write-protect WP_RO
in case VBOOT is enabled.
Tested on Lenovo T520:
The WP_RO region is write-protected.
Change-Id: I72c3e1a0720514b9b85b0433944ab5fb7109b2a2
Signed-off-by: Patrick Rudolph <patrick.rudolph(a)9elements.com>
---
M src/security/lockdown/Kconfig
M src/security/lockdown/bootmedia.c
2 files changed, 29 insertions(+), 1 deletion(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/05/32705/1
diff --git a/src/security/lockdown/Kconfig b/src/security/lockdown/Kconfig
index bb4d072..1e982d8 100644
--- a/src/security/lockdown/Kconfig
+++ b/src/security/lockdown/Kconfig
@@ -15,6 +15,18 @@
config BOOTMEDIA_LOCK_NONE
bool "Don't lock boot media sections"
+config BOOTMEDIA_LOCK_VBOOT_RO
+ bool "Write-protect WP_RO region in boot media"
+ depends on VBOOT
+ help
+ Select this if you want to write-protect the WP_RO region as specified
+ in the VBOOT FMAP. You will only be able to write the regions
+ FW_MAIN_A/FW_MAIN_B, which are not write-protected using the internal
+ programmer.
+ The locking will take place during the chipset lockdown, which
+ is either triggered by coreboot (when INTEL_CHIPSET_LOCKDOWN is set)
+ or has to be triggered later (e.g. by the payload or the OS).
+
config BOOTMEDIA_LOCK_RO
bool "Write-protect the whole boot media"
help
diff --git a/src/security/lockdown/bootmedia.c b/src/security/lockdown/bootmedia.c
index 8fb4ae9..6fa2de2 100644
--- a/src/security/lockdown/bootmedia.c
+++ b/src/security/lockdown/bootmedia.c
@@ -17,6 +17,7 @@
#include <commonlib/region.h>
#include <console/console.h>
#include <bootstate.h>
+#include <fmap.h>
/*
* Enable write protection on the WP_RO region of the bootmedia.
@@ -47,8 +48,23 @@
"of whole bootmedia\n");
locked = true;
}
- }
+ } else if (CONFIG(BOOTMEDIA_LOCK_VBOOT_RO)) {
+ struct region_device dev;
+ if (fmap_locate_area_as_rdev("WP_RO", &dev) < 0) {
+ printk(BIOS_ERR, "BM-LOCKDOWN: Could not find region 'WP_RO'\n");
+ } else {
+ for (size_t i = 0; i < ARRAY_SIZE(wp_prot); i++) {
+ printk(BIOS_DEBUG, "BM-LOCKDOWN: Trying write-protection"
+ "#%zu ...\n", i);
+ if (boot_device_wp_region(&dev, wp_prot[i]) < 0)
+ continue;
+ printk(BIOS_INFO, "BM-LOCKDOWN: Enabled write-protection of"
+ "WP_RO region\n");
+ locked = true;
+ }
+ }
+ }
if (!locked)
printk(BIOS_INFO, "BM-LOCKDOWN: Didn't enable bootmedia protection\n");
}
--
To view, visit https://review.coreboot.org/c/coreboot/+/32705
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I72c3e1a0720514b9b85b0433944ab5fb7109b2a2
Gerrit-Change-Number: 32705
Gerrit-PatchSet: 1
Gerrit-Owner: Patrick Rudolph <patrick.rudolph(a)9elements.com>
Gerrit-MessageType: newchange
Patrick Rudolph has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/32704
Change subject: security: Add common boot media write protection
......................................................................
security: Add common boot media write protection
Introduce boot media protection settings and use the existing
boot_device_wp_region() function to apply settings on all
platforms that supports it yet.
Also remove the Intel southbridge code, which is now obsolete.
Tested on Lenovo T520. The whole flash is protected.
Change-Id: Iceb3ecf0bde5cec562bc62d1d5c79da35305d183
Signed-off-by: Patrick Rudolph <patrick.rudolph(a)9elements.com>
---
M src/security/Kconfig
M src/security/Makefile.inc
A src/security/lockdown/Kconfig
A src/security/lockdown/Makefile.inc
A src/security/lockdown/bootmedia.c
M src/soc/intel/common/block/fast_spi/Kconfig
M src/southbridge/intel/common/Kconfig
M src/southbridge/intel/common/finalize.c
8 files changed, 124 insertions(+), 49 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/04/32704/1
diff --git a/src/security/Kconfig b/src/security/Kconfig
index 6a334ac..99cb054 100644
--- a/src/security/Kconfig
+++ b/src/security/Kconfig
@@ -14,3 +14,4 @@
source "src/security/vboot/Kconfig"
source "src/security/tpm/Kconfig"
+source "src/security/lockdown/Kconfig"
diff --git a/src/security/Makefile.inc b/src/security/Makefile.inc
index a940b82..a74e498 100644
--- a/src/security/Makefile.inc
+++ b/src/security/Makefile.inc
@@ -1,2 +1,3 @@
subdirs-y += vboot
subdirs-y += tpm
+subdirs-y += lockdown
diff --git a/src/security/lockdown/Kconfig b/src/security/lockdown/Kconfig
new file mode 100644
index 0000000..bb4d072
--- /dev/null
+++ b/src/security/lockdown/Kconfig
@@ -0,0 +1,46 @@
+
+config SECURITY_BOOTMEDIA_LOCKDOWN
+ bool
+ default n
+ help
+ Platform support the locking of boot media. This can be for example
+ SPI controller protected regions or flash status register locking.
+
+if SECURITY_BOOTMEDIA_LOCKDOWN
+
+choice
+ prompt "Boot media protection"
+ default BOOTMEDIA_LOCK_NONE
+
+config BOOTMEDIA_LOCK_NONE
+ bool "Don't lock boot media sections"
+
+config BOOTMEDIA_LOCK_RO
+ bool "Write-protect the whole boot media"
+ help
+ Select this if you want to write-protect the whole firmware boot
+ media. The locking will take place during the chipset lockdown, which
+ is either triggered by coreboot (when INTEL_CHIPSET_LOCKDOWN is set)
+ or has to be triggered later (e.g. by the payload or the OS).
+
+ NOTE: If you trigger the chipset lockdown unconditionally,
+ you won't be able to write to the flash chip using the
+ internal programmer any more.
+
+config BOOTMEDIA_LOCK_NO_ACCESS
+ bool "Read- and write-protect the whole boot media"
+ help
+ Select this if you want to protect the firmware boot media against
+ all further accesses. On platforms that memory map a part of the
+ boot media the corresponding region is still readable.
+ The locking will take place during the chipset lockdown, which is
+ either triggered by coreboot (when INTEL_CHIPSET_LOCKDOWN is set) or
+ has to be triggered later (e.g. by the payload or the OS).
+
+ NOTE: If you trigger the chipset lockdown unconditionally,
+ you won't be able to write to the boot media using the
+ internal programmer any more.
+
+endchoice
+
+endif
diff --git a/src/security/lockdown/Makefile.inc b/src/security/lockdown/Makefile.inc
new file mode 100644
index 0000000..c287b9b
--- /dev/null
+++ b/src/security/lockdown/Makefile.inc
@@ -0,0 +1,16 @@
+##
+## This file is part of the coreboot project.
+##
+## Copyright (C) 2019 9elements Agency GmbH <patrick.rudolph(a)9elements.com>
+##
+## This program is free software; you can redistribute it and/or modify
+## it under the terms of the GNU General Public License as published by
+## the Free Software Foundation; version 2 of the License.
+##
+## This program is distributed in the hope that it will be useful,
+## but WITHOUT ANY WARRANTY; without even the implied warranty of
+## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+## GNU General Public License for more details.
+##
+
+ramstage-$(CONFIG_SECURITY_BOOTMEDIA_LOCKDOWN) += bootmedia.c
diff --git a/src/security/lockdown/bootmedia.c b/src/security/lockdown/bootmedia.c
new file mode 100644
index 0000000..8fb4ae9
--- /dev/null
+++ b/src/security/lockdown/bootmedia.c
@@ -0,0 +1,58 @@
+/*
+ * This file is part of the coreboot project.
+ *
+ * Copyright (C) 2019 9elements Agency GmbH <patrick.rudolph(a)9elements.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+
+#include <boot_device.h>
+#include <commonlib/region.h>
+#include <console/console.h>
+#include <bootstate.h>
+
+/*
+ * Enable write protection on the WP_RO region of the bootmedia.
+ */
+static void security_lockdown_bootmedia(void *unused)
+{
+ static const int wp_prot[] = {MEDIA_WP, CTRLR_WP};
+ const struct region_device *rdev;
+ bool locked = false;
+
+ if (CONFIG(BOOTMEDIA_LOCK_RO)) {
+ rdev = boot_device_ro();
+
+ for (size_t i = 0; i < ARRAY_SIZE(wp_prot); i++) {
+ printk(BIOS_DEBUG, "BM-LOCKDOWN: Trying write-protection"
+ "#%zu ...\n", i);
+ if (boot_device_wp_region(rdev, wp_prot[i]) < 0)
+ continue;
+
+ printk(BIOS_INFO, "BM-LOCKDOWN: Enabled write-protection of"
+ "whole bootmedia\n");
+ locked = true;
+ }
+ } else if (CONFIG(BOOTMEDIA_LOCK_NO_ACCESS)) {
+ rdev = boot_device_ro();
+ if (boot_device_wp_region(rdev, CTRLR_RWP) == 0) {
+ printk(BIOS_INFO, "BM-LOCKDOWN: Enabled read- and write protection"
+ "of whole bootmedia\n");
+ locked = true;
+ }
+ }
+
+ if (!locked)
+ printk(BIOS_INFO, "BM-LOCKDOWN: Didn't enable bootmedia protection\n");
+}
+
+/* BS_POST_DEVICE will lock the hardware */
+BOOT_STATE_INIT_ENTRY(BS_DEV_INIT, BS_ON_EXIT, security_lockdown_bootmedia,
+ NULL);
diff --git a/src/soc/intel/common/block/fast_spi/Kconfig b/src/soc/intel/common/block/fast_spi/Kconfig
index 4bd1f59..ff02844 100644
--- a/src/soc/intel/common/block/fast_spi/Kconfig
+++ b/src/soc/intel/common/block/fast_spi/Kconfig
@@ -1,5 +1,6 @@
config SOC_INTEL_COMMON_BLOCK_FAST_SPI
bool
+ select SECURITY_BOOTMEDIA_LOCKDOWN
help
Intel Processor common FAST_SPI support
diff --git a/src/southbridge/intel/common/Kconfig b/src/southbridge/intel/common/Kconfig
index c3bd90d..39234a8 100644
--- a/src/southbridge/intel/common/Kconfig
+++ b/src/southbridge/intel/common/Kconfig
@@ -20,6 +20,7 @@
config SOUTHBRIDGE_INTEL_COMMON_SPI
def_bool n
select SPI_FLASH
+ select SECURITY_BOOTMEDIA_LOCKDOWN
config SOUTHBRIDGE_INTEL_COMMON_PIRQ_ACPI_GEN
def_bool n
@@ -68,42 +69,3 @@
config SOUTHBRIDGE_INTEL_COMMON_WATCHDOG
bool
depends on SOUTHBRIDGE_INTEL_COMMON
-
-if SOUTHBRIDGE_INTEL_COMMON_FINALIZE
-
-choice
- prompt "Flash locking during chipset lockdown"
- default LOCK_SPI_FLASH_NONE
-
-config LOCK_SPI_FLASH_NONE
- bool "Don't lock flash sections"
-
-config LOCK_SPI_FLASH_RO
- bool "Write-protect all flash sections"
- help
- Select this if you want to write-protect the whole firmware flash
- chip. The locking will take place during the chipset lockdown, which
- is either triggered by coreboot (when INTEL_CHIPSET_LOCKDOWN is set)
- or has to be triggered later (e.g. by the payload or the OS).
-
- NOTE: If you trigger the chipset lockdown unconditionally,
- you won't be able to write to the flash chip using the
- internal programmer any more.
-
-config LOCK_SPI_FLASH_NO_ACCESS
- bool "Write-protect all flash sections and read-protect non-BIOS sections"
- help
- Select this if you want to protect the firmware flash against all
- further accesses (with the exception of the memory mapped BIOS re-
- gion which is always readable). The locking will take place during
- the chipset lockdown, which is either triggered by coreboot (when
- INTEL_CHIPSET_LOCKDOWN is set) or has to be triggered later (e.g.
- by the payload or the OS).
-
- NOTE: If you trigger the chipset lockdown unconditionally,
- you won't be able to write to the flash chip using the
- internal programmer any more.
-
-endchoice
-
-endif
diff --git a/src/southbridge/intel/common/finalize.c b/src/southbridge/intel/common/finalize.c
index 80c65bb..6f7934a 100644
--- a/src/southbridge/intel/common/finalize.c
+++ b/src/southbridge/intel/common/finalize.c
@@ -28,16 +28,6 @@
{
const pci_devfn_t lpc_dev = PCI_DEV(0, 0x1f, 0);
- if (CONFIG(LOCK_SPI_FLASH_RO) ||
- CONFIG(LOCK_SPI_FLASH_NO_ACCESS)) {
- int i;
- u32 lockmask = 1UL << 31;
- if (CONFIG(LOCK_SPI_FLASH_NO_ACCESS))
- lockmask |= 1 << 15;
- for (i = 0; i < 20; i += 4)
- RCBA32(0x3874 + i) = RCBA32(0x3854 + i) | lockmask;
- }
-
/* Lock SPIBAR */
RCBA32_OR(0x3804, (1 << 15));
--
To view, visit https://review.coreboot.org/c/coreboot/+/32704
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Iceb3ecf0bde5cec562bc62d1d5c79da35305d183
Gerrit-Change-Number: 32704
Gerrit-PatchSet: 1
Gerrit-Owner: Patrick Rudolph <patrick.rudolph(a)9elements.com>
Gerrit-Reviewer: Martin Roth <martinroth(a)google.com>
Gerrit-Reviewer: Patrick Georgi <pgeorgi(a)google.com>
Gerrit-Reviewer: Patrick Rudolph <patrick.rudolph(a)9elements.com>
Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org>
Gerrit-MessageType: newchange
Hello Nico Huber,
I'd like you to do a code review. Please visit
https://review.coreboot.org/c/coreboot/+/31351
to review the following change.
Change subject: soc/intel/apl: Add chip.h setting for PCIe ASPM
......................................................................
soc/intel/apl: Add chip.h setting for PCIe ASPM
We don't use a direct mapping to the UPD values so we don't have to set
it to the default `auto` in all devicetrees.
Change-Id: I169722c3c63be66772cb57a429ec7b83230fa234
Signed-off-by: Nico Huber <nico.huber(a)secunet.com>
---
M src/soc/intel/apollolake/chip.c
M src/soc/intel/apollolake/chip.h
2 files changed, 18 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/51/31351/1
diff --git a/src/soc/intel/apollolake/chip.c b/src/soc/intel/apollolake/chip.c
index 3634509..cfe8d4a 100644
--- a/src/soc/intel/apollolake/chip.c
+++ b/src/soc/intel/apollolake/chip.c
@@ -669,6 +669,7 @@
{
FSP_S_CONFIG *silconfig = &silupd->FspsConfig;
static struct soc_intel_apollolake_config *cfg;
+ int i;
/* Load VBT before devicetree-specific config. */
silconfig->GraphicsConfigPtr = (uintptr_t)vbt_get();
@@ -693,6 +694,11 @@
memcpy(silconfig->PcieRpHotPlug, cfg->pcie_rp_hotplug_enable,
sizeof(silconfig->PcieRpHotPlug));
+ for (i = 0; i < ARRAY_SIZE(silconfig->PcieRpAspm); ++i) {
+ if (cfg->pcie_rp_aspm[i] != ASPM_IGNORE)
+ silconfig->PcieRpAspm[i] = cfg->pcie_rp_aspm[i] - 1;
+ }
+
switch (cfg->serirq_mode) {
case SERIRQ_QUIET:
silconfig->SirqEnable = 1;
diff --git a/src/soc/intel/apollolake/chip.h b/src/soc/intel/apollolake/chip.h
index b9e368c..b8f9f8c 100644
--- a/src/soc/intel/apollolake/chip.h
+++ b/src/soc/intel/apollolake/chip.h
@@ -57,6 +57,18 @@
/* De-emphasis enable configuration for each PCIe root port */
uint8_t pcie_rp_deemphasis_enable[MAX_PCIE_PORTS];
+ /* ASPM enable setting for each PCIe root port */
+ enum {
+ ASPM_IGNORE = 0,
+ /* Enumeration values below are off-by-one compared to the
+ UPD to have the default 0 ignore the devicetree setting: */
+ ASPM_DISABLED,
+ ASPM_L0S,
+ ASPM_L1,
+ ASPM_L0SL1,
+ ASPM_AUTO,
+ } pcie_rp_aspm[MAX_PCIE_PORTS];
+
/* [14:8] DDR mode Number of dealy elements.Each = 125pSec.
* [6:0] SDR mode Number of dealy elements.Each = 125pSec.
*/
--
To view, visit https://review.coreboot.org/c/coreboot/+/31351
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I169722c3c63be66772cb57a429ec7b83230fa234
Gerrit-Change-Number: 31351
Gerrit-PatchSet: 1
Gerrit-Owner: Thomas Heijligen <src(a)posteo.de>
Gerrit-Reviewer: Nico Huber <nico.h(a)gmx.de>
Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org>
Gerrit-Reviewer: Thomas Heijligen <src(a)posteo.de>
Gerrit-MessageType: newchange
Hello Mike Banon,
I'd like you to do a code review. Please visit
https://review.coreboot.org/c/coreboot/+/31325
to review the following change.
Change subject: lenovo/g505s/Kconfig: Set framebuffer graphics mode to VESA 118h mode
......................................................................
lenovo/g505s/Kconfig: Set framebuffer graphics mode to VESA 118h mode
Set VESA/native framebuffer mode (needed for bootsplash and graphical
framebuffer console) to 118h VESA (1024x768 16.8M-color (8:8:8)) mode
because it's the closest to this laptop's 1366x768 screen resolution.
This provides console output even if e.g. GRUB is the payload.
Signed-off-by: Mike Banon <mikebdp2(a)gmail.com>
Change-Id: I0b4eacf61d905f1160531a988e192c3b626dca68
---
M src/mainboard/lenovo/g505s/Kconfig
1 file changed, 8 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/25/31325/1
diff --git a/src/mainboard/lenovo/g505s/Kconfig b/src/mainboard/lenovo/g505s/Kconfig
index 883ef27..2d1eac7 100644
--- a/src/mainboard/lenovo/g505s/Kconfig
+++ b/src/mainboard/lenovo/g505s/Kconfig
@@ -55,4 +55,12 @@
string
default "1002,990b"
+config FRAMEBUFFER_SET_VESA_MODE
+ bool
+ default y
+
+config FRAMEBUFFER_VESA_DEFAULT_118
+ bool
+ default y
+
endif # BOARD_LENOVO_G505S
--
To view, visit https://review.coreboot.org/c/coreboot/+/31325
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I0b4eacf61d905f1160531a988e192c3b626dca68
Gerrit-Change-Number: 31325
Gerrit-PatchSet: 1
Gerrit-Owner: mikeb mikeb <mikebdp2(a)gmail.com>
Gerrit-Reviewer: Mike Banon <mikebdp2(a)gmail.com>
Gerrit-MessageType: newchange