Hello Aaron Durbin, Frans Hendriks, Philipp Deppenwiese,
I'd like you to do a code review. Please visit
https://review.coreboot.org/c/coreboot/+/32716
to review the following change.
Change subject: vboot: Turn vboot_logic_executed() into a static inline
......................................................................
vboot: Turn vboot_logic_executed() into a static inline
This patch moves vboot_logic_executed() (and its dependencies) into a
header and turns it into a static inline function. The function is used
to guard larger amounts of code in several places, so this should allow
us to safe some more space through compile-time elimination (and also
makes it easier to avoid undefined reference issues in some cases).
Change-Id: I193f608882cbfe07dc91ee90d02fafbd67a3c324
Signed-off-by: Julius Werner <jwerner(a)chromium.org>
---
M src/security/vboot/misc.h
M src/security/vboot/vboot_loader.c
2 files changed, 58 insertions(+), 54 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/16/32716/1
diff --git a/src/security/vboot/misc.h b/src/security/vboot/misc.h
index b4fae19..2a0523d 100644
--- a/src/security/vboot/misc.h
+++ b/src/security/vboot/misc.h
@@ -16,6 +16,8 @@
#ifndef __VBOOT_MISC_H__
#define __VBOOT_MISC_H__
+#include <assert.h>
+#include <arch/early_variables.h>
#include <security/vboot/vboot_common.h>
struct vb2_context;
@@ -66,13 +68,63 @@
void vboot_fill_handoff(void);
/*
- * Source: security/vboot/vboot_loader.c
- */
-int vboot_logic_executed(void);
-
-/*
* Source: security/vboot/bootmode.c
*/
void vboot_save_recovery_reason_vbnv(void);
+/*
+ * The stage loading code is compiled and entered from multiple stages. The
+ * helper functions below attempt to provide more clarity on when certain
+ * code should be called. They are implemented inline for better compile-time
+ * code elimination.
+ */
+
+static inline int verification_should_run(void)
+{
+ if (CONFIG(VBOOT_SEPARATE_VERSTAGE))
+ return ENV_VERSTAGE;
+ else if (CONFIG(VBOOT_STARTS_IN_ROMSTAGE))
+ return ENV_ROMSTAGE;
+ else if (CONFIG(VBOOT_STARTS_IN_BOOTBLOCK))
+ return ENV_BOOTBLOCK;
+ else
+ dead_code();
+}
+
+static inline int verstage_should_load(void)
+{
+ if (CONFIG(VBOOT_SEPARATE_VERSTAGE))
+ return ENV_BOOTBLOCK;
+ else
+ return 0;
+}
+
+/* Only for use by functions in this header, do not access directly! */
+extern int vboot_executed;
+
+static inline int vboot_logic_executed(void)
+{
+ /* If we are in the stage that runs verification, or in the stage that
+ both loads the verstage and is returned to from it afterwards, we
+ need to check a global to see if verfication has run. */
+ if (verification_should_run() ||
+ (verstage_should_load() && CONFIG(VBOOT_RETURN_FROM_VERSTAGE)))
+ return car_get_var(vboot_executed);
+
+ if (CONFIG(VBOOT_STARTS_IN_BOOTBLOCK)) {
+ /* All other stages are "after the bootblock" */
+ return !ENV_BOOTBLOCK;
+ } else if (CONFIG(VBOOT_STARTS_IN_ROMSTAGE)) {
+ /* Post-RAM stages are "after the romstage" */
+#ifdef __PRE_RAM__
+ return 0;
+#else
+ return 1;
+#endif
+ } else {
+ dead_code();
+ }
+}
+
+
#endif /* __VBOOT_MISC_H__ */
diff --git a/src/security/vboot/vboot_loader.c b/src/security/vboot/vboot_loader.c
index 3bbb3da..1350307 100644
--- a/src/security/vboot/vboot_loader.c
+++ b/src/security/vboot/vboot_loader.c
@@ -36,55 +36,7 @@
CONFIG(VBOOT_SEPARATE_VERSTAGE),
"return from verstage only makes sense for separate verstages");
-/* The stage loading code is compiled and entered from multiple stages. The
- * helper functions below attempt to provide more clarity on when certain
- * code should be called. */
-
-static int verification_should_run(void)
-{
- if (CONFIG(VBOOT_SEPARATE_VERSTAGE))
- return ENV_VERSTAGE;
- else if (CONFIG(VBOOT_STARTS_IN_ROMSTAGE))
- return ENV_ROMSTAGE;
- else if (CONFIG(VBOOT_STARTS_IN_BOOTBLOCK))
- return ENV_BOOTBLOCK;
- else
- die("impossible!");
-}
-
-static int verstage_should_load(void)
-{
- if (CONFIG(VBOOT_SEPARATE_VERSTAGE))
- return ENV_BOOTBLOCK;
- else
- return 0;
-}
-
-static int vboot_executed CAR_GLOBAL;
-
-int vboot_logic_executed(void)
-{
- /* If we are in the stage that runs verification, or in the stage that
- both loads the verstage and is returned to from it afterwards, we
- need to check a global to see if verfication has run. */
- if (verification_should_run() ||
- (verstage_should_load() && CONFIG(VBOOT_RETURN_FROM_VERSTAGE)))
- return car_get_var(vboot_executed);
-
- if (CONFIG(VBOOT_STARTS_IN_BOOTBLOCK)) {
- /* All other stages are "after the bootblock" */
- return !ENV_BOOTBLOCK;
- } else if (CONFIG(VBOOT_STARTS_IN_ROMSTAGE)) {
- /* Post-RAM stages are "after the romstage" */
-#ifdef __PRE_RAM__
- return 0;
-#else
- return 1;
-#endif
- } else {
- die("impossible!");
- }
-}
+int vboot_executed CAR_GLOBAL;
static void vboot_prepare(void)
{
--
To view, visit https://review.coreboot.org/c/coreboot/+/32716
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I193f608882cbfe07dc91ee90d02fafbd67a3c324
Gerrit-Change-Number: 32716
Gerrit-PatchSet: 1
Gerrit-Owner: Julius Werner <jwerner(a)chromium.org>
Gerrit-Reviewer: Aaron Durbin <adurbin(a)chromium.org>
Gerrit-Reviewer: Frans Hendriks <fhendriks(a)eltan.com>
Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org>
Gerrit-Reviewer: Philipp Deppenwiese <zaolin.daisuki(a)gmail.com>
Gerrit-MessageType: newchange
John Zhao has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/33232
Change subject: src/cpu/x86: Check pointer processor_name_start before dereference
......................................................................
src/cpu/x86: Check pointer processor_name_start before dereference
Clang Static Analyzer version 8.0.0 detects the left operand of '=='
is a garbage value if pointer processor_name_start is NULL. Add sanity
check for processor_name_start before dereference.
TEST=Built and boot up to kernel.
Change-Id: I1f831a8661a4686d306b8217655942934102ea16
Signed-off-by: John Zhao <john.zhao(a)intel.com>
---
M src/cpu/x86/name/name.c
1 file changed, 3 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/32/33232/1
diff --git a/src/cpu/x86/name/name.c b/src/cpu/x86/name/name.c
index fc360cd..44a1cf0 100644
--- a/src/cpu/x86/name/name.c
+++ b/src/cpu/x86/name/name.c
@@ -37,6 +37,9 @@
/* Skip leading spaces. */
processor_name_start = (char *)name_as_ints;
+ if (!processor_name_start)
+ return;
+
while (*processor_name_start == ' ')
processor_name_start++;
--
To view, visit https://review.coreboot.org/c/coreboot/+/33232
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I1f831a8661a4686d306b8217655942934102ea16
Gerrit-Change-Number: 33232
Gerrit-PatchSet: 1
Gerrit-Owner: John Zhao <john.zhao(a)intel.com>
Gerrit-MessageType: newchange
Hello Martin Roth, Furquan Shaikh,
I'd like you to do a code review. Please visit
https://review.coreboot.org/c/coreboot/+/34423
to review the following change.
Change subject: soc/amd/picasso: Begin adding FSP support
......................................................................
soc/amd/picasso: Begin adding FSP support
AMD has rewritten AGESA (now at v9) for direct inclusion into UEFI
build environments. Unlike Arch2008 (a.k.a. v5), it can't be built
without additional source, e.g. in EDK II, and has no entry points
for easy inclusion into a legacy BIOS.
AGESA in coreboot now relies on the FSP 2.0 framework published
by Intel and uses the existing fsp2_0 driver.
* Add fsp_memory_init() to romstage.c. Although Picasso comes out
of reset with DRAM alive, this call is added to maximize
compatibility and facilitate internal development. Future work
may look at removing it.
* Remove cbmem initialization, as the FSP driver does this step.
* Add chipset_handle_reset() for compatibility.
* Increase the size set to WB for ramstage, as ramstage outgrew
the region.
Change-Id: Iecb3a3f2599a8ccbc168b1d26a0271f51b71dcf0
Signed-off-by: Marshall Dawson <marshalldawson3rd(a)gmail.com>
---
M src/soc/amd/picasso/Kconfig
M src/soc/amd/picasso/chip.c
M src/soc/amd/picasso/reset.c
M src/soc/amd/picasso/romstage.c
4 files changed, 44 insertions(+), 9 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/23/34423/1
diff --git a/src/soc/amd/picasso/Kconfig b/src/soc/amd/picasso/Kconfig
index 840de12..3c27f15 100644
--- a/src/soc/amd/picasso/Kconfig
+++ b/src/soc/amd/picasso/Kconfig
@@ -61,6 +61,18 @@
select POSTCAR_CONSOLE
select SSE2
select RTC
+ select PLATFORM_USES_FSP2_0
+ select UDK_2015_BINDING
+ select ADD_FSP_BINARIES
+ select HAVE_CF9_RESET
+
+config FSP_DEBUG_ALL
+ bool "Enable all FSP debug support"
+ default y
+ select DISPLAY_HOBS
+ select DISPLAY_UPD_DATA
+ select DISPLAY_FSP_CALLS_AND_STATUS
+ select DISPLAY_FSP_HEADER
config VBOOT
select VBOOT_SEPARATE_VERSTAGE
diff --git a/src/soc/amd/picasso/chip.c b/src/soc/amd/picasso/chip.c
index 8d49271..d94091d 100644
--- a/src/soc/amd/picasso/chip.c
+++ b/src/soc/amd/picasso/chip.c
@@ -26,6 +26,7 @@
#include <soc/pci_devs.h>
#include <soc/southbridge.h>
#include "chip.h"
+#include <fsp/api.h>
/* Supplied by i2c.c */
extern struct device_operations picasso_i2c_mmio_ops;
@@ -117,6 +118,8 @@
static void soc_init(void *chip_info)
{
+ fsp_silicon_init(acpi_is_wakeup_s3());
+
southbridge_init(chip_info);
setup_bsp_ramtop();
}
diff --git a/src/soc/amd/picasso/reset.c b/src/soc/amd/picasso/reset.c
index 9841038..03cf306 100644
--- a/src/soc/amd/picasso/reset.c
+++ b/src/soc/amd/picasso/reset.c
@@ -22,6 +22,7 @@
#include <soc/southbridge.h>
#include <amdblocks/acpimmio.h>
#include <amdblocks/reset.h>
+#include <fsp/util.h>
void set_warm_reset_flag(void)
{
@@ -56,3 +57,17 @@
/* TODO: Would a warm_reset() suffice? */
do_cold_reset();
}
+
+void chipset_handle_reset(uint32_t status)
+{
+ switch (status) {
+ case FSP_STATUS_RESET_REQUIRED_3: /* Global Reset */
+ printk(BIOS_DEBUG, "GLOBAL RESET!!\n");
+ do_cold_reset();
+ break;
+ default:
+ printk(BIOS_ERR, "unhandled reset type %x\n", status);
+ die("unknown reset type");
+ break;
+ }
+}
diff --git a/src/soc/amd/picasso/romstage.c b/src/soc/amd/picasso/romstage.c
index da4ed8d..2b2813d 100644
--- a/src/soc/amd/picasso/romstage.c
+++ b/src/soc/amd/picasso/romstage.c
@@ -37,6 +37,7 @@
#include <soc/northbridge.h>
#include <soc/southbridge.h>
#include <soc/romstage.h>
+#include <fsp/api.h>
__weak void romstage_mainboard_early_init(void) {}
__weak void romstage_mainboard_init(int s3_resume) {}
@@ -80,6 +81,11 @@
timestamp_add(TS_START_ROMSTAGE, stage_start);
}
+void platform_fsp_memory_init_params_cb(FSPM_UPD *mupd, uint32_t version)
+{
+ // dummy
+}
+
asmlinkage void car_stage_entry(void)
{
struct postcar_frame pcf;
@@ -137,27 +143,26 @@
boot_count_increment();
post_code(0x49);
+
+ /* fsp_memory_init() requires cbmem_top() before returning. Use TOM.
+ * todo: verify TOM < UMA region when UMA is below 4GB */
msr_t tom = rdmsr(TOP_MEM);
tom.lo &= ~0xffffff;
backup_top_of_low_cacheable(tom.lo);
- post_code(0x4a);
- if (cbmem_recovery(s3_resume))
- printk(BIOS_CRIT, "Failed to recover cbmem\n");
- if (romstage_handoff_init(s3_resume))
- printk(BIOS_ERR, "Failed to set romstage handoff data\n");
+ fsp_memory_init(s3_resume);
- post_code(0x4b);
+ post_code(0x4a);
if (postcar_frame_init(&pcf, 1 * KiB))
die("Unable to initialize postcar frame.\n");
/*
* We need to make sure ramstage will be run cached. At this point exact
* location of ramstage in cbmem is not known. Instruct postcar to cache
- * 16 megs under cbmem top which is a safe bet to cover ramstage.
+ * 32 megs under cbmem top which is a safe bet to cover ramstage.
*/
top_of_ram = (uintptr_t) cbmem_top();
- postcar_frame_add_mtrr(&pcf, top_of_ram - 16*MiB, 16*MiB,
+ postcar_frame_add_mtrr(&pcf, top_of_ram - 32*MiB, 32*MiB,
MTRR_TYPE_WRBACK);
/* Cache the memory-mapped boot media. */
@@ -174,7 +179,7 @@
tseg_base = (uintptr_t)smm_base;
postcar_frame_add_mtrr(&pcf, tseg_base, smm_size, MTRR_TYPE_WRBACK);
- post_code(0x4c);
+ post_code(0x4b);
run_postcar_phase(&pcf);
post_code(0x50); /* Should never see this post code. */
--
To view, visit https://review.coreboot.org/c/coreboot/+/34423
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Iecb3a3f2599a8ccbc168b1d26a0271f51b71dcf0
Gerrit-Change-Number: 34423
Gerrit-PatchSet: 1
Gerrit-Owner: Marshall Dawson <marshalldawson3rd(a)gmail.com>
Gerrit-Reviewer: Furquan Shaikh <furquan(a)google.com>
Gerrit-Reviewer: Martin Roth <martinroth(a)google.com>
Gerrit-MessageType: newchange
Felix Singer has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/31086
Change subject: payloads/ipxe: Enable HTTPS support
......................................................................
payloads/ipxe: Enable HTTPS support
HTTPS needs a newer iPXE version than 2017.3,
because it doesn't work with this release.
Tested under master branch.
Change-Id: Ia25d4ce9260fa8c00fdea0e19f5e927559371af0
Signed-off-by: Felix Singer <migy(a)darmstadt.ccc.de>
---
M payloads/external/iPXE/Makefile
1 file changed, 1 insertion(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/86/31086/1
diff --git a/payloads/external/iPXE/Makefile b/payloads/external/iPXE/Makefile
index a8b1245..05b6f4dd 100644
--- a/payloads/external/iPXE/Makefile
+++ b/payloads/external/iPXE/Makefile
@@ -54,6 +54,7 @@
sed 's|#define\s*COMCONSOLE.*|#define COMCONSOLE $(IPXE_UART)|' "$(project_dir)/src/config/serial.h" > "$(project_dir)/src/config/serial.h.tmp"
sed 's|#define\s*COMSPEED.*|#define COMSPEED $(CONFIG_TTYS0_BAUD)|' "$(project_dir)/src/config/serial.h.tmp" > "$(project_dir)/src/config/serial.h"
endif
+ sed -ie 's|.*DOWNLOAD_PROTO_HTTPS|#define DOWNLOAD_PROTO_HTTPS|g' "$(project_dir)/src/config/general.h"
build: config
echo " MAKE $(project_name) $(TAG-y)"
--
To view, visit https://review.coreboot.org/c/coreboot/+/31086
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ia25d4ce9260fa8c00fdea0e19f5e927559371af0
Gerrit-Change-Number: 31086
Gerrit-PatchSet: 1
Gerrit-Owner: Felix Singer <migy(a)darmstadt.ccc.de>
Gerrit-MessageType: newchange
Patrick Rudolph has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/32705
Change subject: security/lockdown: Write-protect WP_RO
......................................................................
security/lockdown: Write-protect WP_RO
Add another choice to boot media protection and write-protect WP_RO
in case VBOOT is enabled.
Tested on Lenovo T520:
The WP_RO region is write-protected.
Change-Id: I72c3e1a0720514b9b85b0433944ab5fb7109b2a2
Signed-off-by: Patrick Rudolph <patrick.rudolph(a)9elements.com>
---
M src/security/lockdown/Kconfig
M src/security/lockdown/bootmedia.c
2 files changed, 29 insertions(+), 1 deletion(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/05/32705/1
diff --git a/src/security/lockdown/Kconfig b/src/security/lockdown/Kconfig
index bb4d072..1e982d8 100644
--- a/src/security/lockdown/Kconfig
+++ b/src/security/lockdown/Kconfig
@@ -15,6 +15,18 @@
config BOOTMEDIA_LOCK_NONE
bool "Don't lock boot media sections"
+config BOOTMEDIA_LOCK_VBOOT_RO
+ bool "Write-protect WP_RO region in boot media"
+ depends on VBOOT
+ help
+ Select this if you want to write-protect the WP_RO region as specified
+ in the VBOOT FMAP. You will only be able to write the regions
+ FW_MAIN_A/FW_MAIN_B, which are not write-protected using the internal
+ programmer.
+ The locking will take place during the chipset lockdown, which
+ is either triggered by coreboot (when INTEL_CHIPSET_LOCKDOWN is set)
+ or has to be triggered later (e.g. by the payload or the OS).
+
config BOOTMEDIA_LOCK_RO
bool "Write-protect the whole boot media"
help
diff --git a/src/security/lockdown/bootmedia.c b/src/security/lockdown/bootmedia.c
index 8fb4ae9..6fa2de2 100644
--- a/src/security/lockdown/bootmedia.c
+++ b/src/security/lockdown/bootmedia.c
@@ -17,6 +17,7 @@
#include <commonlib/region.h>
#include <console/console.h>
#include <bootstate.h>
+#include <fmap.h>
/*
* Enable write protection on the WP_RO region of the bootmedia.
@@ -47,8 +48,23 @@
"of whole bootmedia\n");
locked = true;
}
- }
+ } else if (CONFIG(BOOTMEDIA_LOCK_VBOOT_RO)) {
+ struct region_device dev;
+ if (fmap_locate_area_as_rdev("WP_RO", &dev) < 0) {
+ printk(BIOS_ERR, "BM-LOCKDOWN: Could not find region 'WP_RO'\n");
+ } else {
+ for (size_t i = 0; i < ARRAY_SIZE(wp_prot); i++) {
+ printk(BIOS_DEBUG, "BM-LOCKDOWN: Trying write-protection"
+ "#%zu ...\n", i);
+ if (boot_device_wp_region(&dev, wp_prot[i]) < 0)
+ continue;
+ printk(BIOS_INFO, "BM-LOCKDOWN: Enabled write-protection of"
+ "WP_RO region\n");
+ locked = true;
+ }
+ }
+ }
if (!locked)
printk(BIOS_INFO, "BM-LOCKDOWN: Didn't enable bootmedia protection\n");
}
--
To view, visit https://review.coreboot.org/c/coreboot/+/32705
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I72c3e1a0720514b9b85b0433944ab5fb7109b2a2
Gerrit-Change-Number: 32705
Gerrit-PatchSet: 1
Gerrit-Owner: Patrick Rudolph <patrick.rudolph(a)9elements.com>
Gerrit-MessageType: newchange
Patrick Rudolph has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/32704
Change subject: security: Add common boot media write protection
......................................................................
security: Add common boot media write protection
Introduce boot media protection settings and use the existing
boot_device_wp_region() function to apply settings on all
platforms that supports it yet.
Also remove the Intel southbridge code, which is now obsolete.
Tested on Lenovo T520. The whole flash is protected.
Change-Id: Iceb3ecf0bde5cec562bc62d1d5c79da35305d183
Signed-off-by: Patrick Rudolph <patrick.rudolph(a)9elements.com>
---
M src/security/Kconfig
M src/security/Makefile.inc
A src/security/lockdown/Kconfig
A src/security/lockdown/Makefile.inc
A src/security/lockdown/bootmedia.c
M src/soc/intel/common/block/fast_spi/Kconfig
M src/southbridge/intel/common/Kconfig
M src/southbridge/intel/common/finalize.c
8 files changed, 124 insertions(+), 49 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/04/32704/1
diff --git a/src/security/Kconfig b/src/security/Kconfig
index 6a334ac..99cb054 100644
--- a/src/security/Kconfig
+++ b/src/security/Kconfig
@@ -14,3 +14,4 @@
source "src/security/vboot/Kconfig"
source "src/security/tpm/Kconfig"
+source "src/security/lockdown/Kconfig"
diff --git a/src/security/Makefile.inc b/src/security/Makefile.inc
index a940b82..a74e498 100644
--- a/src/security/Makefile.inc
+++ b/src/security/Makefile.inc
@@ -1,2 +1,3 @@
subdirs-y += vboot
subdirs-y += tpm
+subdirs-y += lockdown
diff --git a/src/security/lockdown/Kconfig b/src/security/lockdown/Kconfig
new file mode 100644
index 0000000..bb4d072
--- /dev/null
+++ b/src/security/lockdown/Kconfig
@@ -0,0 +1,46 @@
+
+config SECURITY_BOOTMEDIA_LOCKDOWN
+ bool
+ default n
+ help
+ Platform support the locking of boot media. This can be for example
+ SPI controller protected regions or flash status register locking.
+
+if SECURITY_BOOTMEDIA_LOCKDOWN
+
+choice
+ prompt "Boot media protection"
+ default BOOTMEDIA_LOCK_NONE
+
+config BOOTMEDIA_LOCK_NONE
+ bool "Don't lock boot media sections"
+
+config BOOTMEDIA_LOCK_RO
+ bool "Write-protect the whole boot media"
+ help
+ Select this if you want to write-protect the whole firmware boot
+ media. The locking will take place during the chipset lockdown, which
+ is either triggered by coreboot (when INTEL_CHIPSET_LOCKDOWN is set)
+ or has to be triggered later (e.g. by the payload or the OS).
+
+ NOTE: If you trigger the chipset lockdown unconditionally,
+ you won't be able to write to the flash chip using the
+ internal programmer any more.
+
+config BOOTMEDIA_LOCK_NO_ACCESS
+ bool "Read- and write-protect the whole boot media"
+ help
+ Select this if you want to protect the firmware boot media against
+ all further accesses. On platforms that memory map a part of the
+ boot media the corresponding region is still readable.
+ The locking will take place during the chipset lockdown, which is
+ either triggered by coreboot (when INTEL_CHIPSET_LOCKDOWN is set) or
+ has to be triggered later (e.g. by the payload or the OS).
+
+ NOTE: If you trigger the chipset lockdown unconditionally,
+ you won't be able to write to the boot media using the
+ internal programmer any more.
+
+endchoice
+
+endif
diff --git a/src/security/lockdown/Makefile.inc b/src/security/lockdown/Makefile.inc
new file mode 100644
index 0000000..c287b9b
--- /dev/null
+++ b/src/security/lockdown/Makefile.inc
@@ -0,0 +1,16 @@
+##
+## This file is part of the coreboot project.
+##
+## Copyright (C) 2019 9elements Agency GmbH <patrick.rudolph(a)9elements.com>
+##
+## This program is free software; you can redistribute it and/or modify
+## it under the terms of the GNU General Public License as published by
+## the Free Software Foundation; version 2 of the License.
+##
+## This program is distributed in the hope that it will be useful,
+## but WITHOUT ANY WARRANTY; without even the implied warranty of
+## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+## GNU General Public License for more details.
+##
+
+ramstage-$(CONFIG_SECURITY_BOOTMEDIA_LOCKDOWN) += bootmedia.c
diff --git a/src/security/lockdown/bootmedia.c b/src/security/lockdown/bootmedia.c
new file mode 100644
index 0000000..8fb4ae9
--- /dev/null
+++ b/src/security/lockdown/bootmedia.c
@@ -0,0 +1,58 @@
+/*
+ * This file is part of the coreboot project.
+ *
+ * Copyright (C) 2019 9elements Agency GmbH <patrick.rudolph(a)9elements.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+
+#include <boot_device.h>
+#include <commonlib/region.h>
+#include <console/console.h>
+#include <bootstate.h>
+
+/*
+ * Enable write protection on the WP_RO region of the bootmedia.
+ */
+static void security_lockdown_bootmedia(void *unused)
+{
+ static const int wp_prot[] = {MEDIA_WP, CTRLR_WP};
+ const struct region_device *rdev;
+ bool locked = false;
+
+ if (CONFIG(BOOTMEDIA_LOCK_RO)) {
+ rdev = boot_device_ro();
+
+ for (size_t i = 0; i < ARRAY_SIZE(wp_prot); i++) {
+ printk(BIOS_DEBUG, "BM-LOCKDOWN: Trying write-protection"
+ "#%zu ...\n", i);
+ if (boot_device_wp_region(rdev, wp_prot[i]) < 0)
+ continue;
+
+ printk(BIOS_INFO, "BM-LOCKDOWN: Enabled write-protection of"
+ "whole bootmedia\n");
+ locked = true;
+ }
+ } else if (CONFIG(BOOTMEDIA_LOCK_NO_ACCESS)) {
+ rdev = boot_device_ro();
+ if (boot_device_wp_region(rdev, CTRLR_RWP) == 0) {
+ printk(BIOS_INFO, "BM-LOCKDOWN: Enabled read- and write protection"
+ "of whole bootmedia\n");
+ locked = true;
+ }
+ }
+
+ if (!locked)
+ printk(BIOS_INFO, "BM-LOCKDOWN: Didn't enable bootmedia protection\n");
+}
+
+/* BS_POST_DEVICE will lock the hardware */
+BOOT_STATE_INIT_ENTRY(BS_DEV_INIT, BS_ON_EXIT, security_lockdown_bootmedia,
+ NULL);
diff --git a/src/soc/intel/common/block/fast_spi/Kconfig b/src/soc/intel/common/block/fast_spi/Kconfig
index 4bd1f59..ff02844 100644
--- a/src/soc/intel/common/block/fast_spi/Kconfig
+++ b/src/soc/intel/common/block/fast_spi/Kconfig
@@ -1,5 +1,6 @@
config SOC_INTEL_COMMON_BLOCK_FAST_SPI
bool
+ select SECURITY_BOOTMEDIA_LOCKDOWN
help
Intel Processor common FAST_SPI support
diff --git a/src/southbridge/intel/common/Kconfig b/src/southbridge/intel/common/Kconfig
index c3bd90d..39234a8 100644
--- a/src/southbridge/intel/common/Kconfig
+++ b/src/southbridge/intel/common/Kconfig
@@ -20,6 +20,7 @@
config SOUTHBRIDGE_INTEL_COMMON_SPI
def_bool n
select SPI_FLASH
+ select SECURITY_BOOTMEDIA_LOCKDOWN
config SOUTHBRIDGE_INTEL_COMMON_PIRQ_ACPI_GEN
def_bool n
@@ -68,42 +69,3 @@
config SOUTHBRIDGE_INTEL_COMMON_WATCHDOG
bool
depends on SOUTHBRIDGE_INTEL_COMMON
-
-if SOUTHBRIDGE_INTEL_COMMON_FINALIZE
-
-choice
- prompt "Flash locking during chipset lockdown"
- default LOCK_SPI_FLASH_NONE
-
-config LOCK_SPI_FLASH_NONE
- bool "Don't lock flash sections"
-
-config LOCK_SPI_FLASH_RO
- bool "Write-protect all flash sections"
- help
- Select this if you want to write-protect the whole firmware flash
- chip. The locking will take place during the chipset lockdown, which
- is either triggered by coreboot (when INTEL_CHIPSET_LOCKDOWN is set)
- or has to be triggered later (e.g. by the payload or the OS).
-
- NOTE: If you trigger the chipset lockdown unconditionally,
- you won't be able to write to the flash chip using the
- internal programmer any more.
-
-config LOCK_SPI_FLASH_NO_ACCESS
- bool "Write-protect all flash sections and read-protect non-BIOS sections"
- help
- Select this if you want to protect the firmware flash against all
- further accesses (with the exception of the memory mapped BIOS re-
- gion which is always readable). The locking will take place during
- the chipset lockdown, which is either triggered by coreboot (when
- INTEL_CHIPSET_LOCKDOWN is set) or has to be triggered later (e.g.
- by the payload or the OS).
-
- NOTE: If you trigger the chipset lockdown unconditionally,
- you won't be able to write to the flash chip using the
- internal programmer any more.
-
-endchoice
-
-endif
diff --git a/src/southbridge/intel/common/finalize.c b/src/southbridge/intel/common/finalize.c
index 80c65bb..6f7934a 100644
--- a/src/southbridge/intel/common/finalize.c
+++ b/src/southbridge/intel/common/finalize.c
@@ -28,16 +28,6 @@
{
const pci_devfn_t lpc_dev = PCI_DEV(0, 0x1f, 0);
- if (CONFIG(LOCK_SPI_FLASH_RO) ||
- CONFIG(LOCK_SPI_FLASH_NO_ACCESS)) {
- int i;
- u32 lockmask = 1UL << 31;
- if (CONFIG(LOCK_SPI_FLASH_NO_ACCESS))
- lockmask |= 1 << 15;
- for (i = 0; i < 20; i += 4)
- RCBA32(0x3874 + i) = RCBA32(0x3854 + i) | lockmask;
- }
-
/* Lock SPIBAR */
RCBA32_OR(0x3804, (1 << 15));
--
To view, visit https://review.coreboot.org/c/coreboot/+/32704
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Iceb3ecf0bde5cec562bc62d1d5c79da35305d183
Gerrit-Change-Number: 32704
Gerrit-PatchSet: 1
Gerrit-Owner: Patrick Rudolph <patrick.rudolph(a)9elements.com>
Gerrit-Reviewer: Martin Roth <martinroth(a)google.com>
Gerrit-Reviewer: Patrick Georgi <pgeorgi(a)google.com>
Gerrit-Reviewer: Patrick Rudolph <patrick.rudolph(a)9elements.com>
Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org>
Gerrit-MessageType: newchange
Hello Nico Huber,
I'd like you to do a code review. Please visit
https://review.coreboot.org/c/coreboot/+/31351
to review the following change.
Change subject: soc/intel/apl: Add chip.h setting for PCIe ASPM
......................................................................
soc/intel/apl: Add chip.h setting for PCIe ASPM
We don't use a direct mapping to the UPD values so we don't have to set
it to the default `auto` in all devicetrees.
Change-Id: I169722c3c63be66772cb57a429ec7b83230fa234
Signed-off-by: Nico Huber <nico.huber(a)secunet.com>
---
M src/soc/intel/apollolake/chip.c
M src/soc/intel/apollolake/chip.h
2 files changed, 18 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/51/31351/1
diff --git a/src/soc/intel/apollolake/chip.c b/src/soc/intel/apollolake/chip.c
index 3634509..cfe8d4a 100644
--- a/src/soc/intel/apollolake/chip.c
+++ b/src/soc/intel/apollolake/chip.c
@@ -669,6 +669,7 @@
{
FSP_S_CONFIG *silconfig = &silupd->FspsConfig;
static struct soc_intel_apollolake_config *cfg;
+ int i;
/* Load VBT before devicetree-specific config. */
silconfig->GraphicsConfigPtr = (uintptr_t)vbt_get();
@@ -693,6 +694,11 @@
memcpy(silconfig->PcieRpHotPlug, cfg->pcie_rp_hotplug_enable,
sizeof(silconfig->PcieRpHotPlug));
+ for (i = 0; i < ARRAY_SIZE(silconfig->PcieRpAspm); ++i) {
+ if (cfg->pcie_rp_aspm[i] != ASPM_IGNORE)
+ silconfig->PcieRpAspm[i] = cfg->pcie_rp_aspm[i] - 1;
+ }
+
switch (cfg->serirq_mode) {
case SERIRQ_QUIET:
silconfig->SirqEnable = 1;
diff --git a/src/soc/intel/apollolake/chip.h b/src/soc/intel/apollolake/chip.h
index b9e368c..b8f9f8c 100644
--- a/src/soc/intel/apollolake/chip.h
+++ b/src/soc/intel/apollolake/chip.h
@@ -57,6 +57,18 @@
/* De-emphasis enable configuration for each PCIe root port */
uint8_t pcie_rp_deemphasis_enable[MAX_PCIE_PORTS];
+ /* ASPM enable setting for each PCIe root port */
+ enum {
+ ASPM_IGNORE = 0,
+ /* Enumeration values below are off-by-one compared to the
+ UPD to have the default 0 ignore the devicetree setting: */
+ ASPM_DISABLED,
+ ASPM_L0S,
+ ASPM_L1,
+ ASPM_L0SL1,
+ ASPM_AUTO,
+ } pcie_rp_aspm[MAX_PCIE_PORTS];
+
/* [14:8] DDR mode Number of dealy elements.Each = 125pSec.
* [6:0] SDR mode Number of dealy elements.Each = 125pSec.
*/
--
To view, visit https://review.coreboot.org/c/coreboot/+/31351
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I169722c3c63be66772cb57a429ec7b83230fa234
Gerrit-Change-Number: 31351
Gerrit-PatchSet: 1
Gerrit-Owner: Thomas Heijligen <src(a)posteo.de>
Gerrit-Reviewer: Nico Huber <nico.h(a)gmx.de>
Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org>
Gerrit-Reviewer: Thomas Heijligen <src(a)posteo.de>
Gerrit-MessageType: newchange