Hello Martin Roth, Furquan Shaikh,
I'd like you to do a code review. Please visit
https://review.coreboot.org/c/coreboot/+/34423
to review the following change.
Change subject: soc/amd/picasso: Begin adding FSP support
......................................................................
soc/amd/picasso: Begin adding FSP support
AMD has rewritten AGESA (now at v9) for direct inclusion into UEFI
build environments. Unlike Arch2008 (a.k.a. v5), it can't be built
without additional source, e.g. in EDK II, and has no entry points
for easy inclusion into a legacy BIOS.
AGESA in coreboot now relies on the FSP 2.0 framework published
by Intel and uses the existing fsp2_0 driver.
* Add fsp_memory_init() to romstage.c. Although Picasso comes out
of reset with DRAM alive, this call is added to maximize
compatibility and facilitate internal development. Future work
may look at removing it.
* Remove cbmem initialization, as the FSP driver does this step.
* Add chipset_handle_reset() for compatibility.
* Increase the size set to WB for ramstage, as ramstage outgrew
the region.
Change-Id: Iecb3a3f2599a8ccbc168b1d26a0271f51b71dcf0
Signed-off-by: Marshall Dawson <marshalldawson3rd(a)gmail.com>
---
M src/soc/amd/picasso/Kconfig
M src/soc/amd/picasso/chip.c
M src/soc/amd/picasso/reset.c
M src/soc/amd/picasso/romstage.c
4 files changed, 44 insertions(+), 9 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/23/34423/1
diff --git a/src/soc/amd/picasso/Kconfig b/src/soc/amd/picasso/Kconfig
index 840de12..3c27f15 100644
--- a/src/soc/amd/picasso/Kconfig
+++ b/src/soc/amd/picasso/Kconfig
@@ -61,6 +61,18 @@
select POSTCAR_CONSOLE
select SSE2
select RTC
+ select PLATFORM_USES_FSP2_0
+ select UDK_2015_BINDING
+ select ADD_FSP_BINARIES
+ select HAVE_CF9_RESET
+
+config FSP_DEBUG_ALL
+ bool "Enable all FSP debug support"
+ default y
+ select DISPLAY_HOBS
+ select DISPLAY_UPD_DATA
+ select DISPLAY_FSP_CALLS_AND_STATUS
+ select DISPLAY_FSP_HEADER
config VBOOT
select VBOOT_SEPARATE_VERSTAGE
diff --git a/src/soc/amd/picasso/chip.c b/src/soc/amd/picasso/chip.c
index 8d49271..d94091d 100644
--- a/src/soc/amd/picasso/chip.c
+++ b/src/soc/amd/picasso/chip.c
@@ -26,6 +26,7 @@
#include <soc/pci_devs.h>
#include <soc/southbridge.h>
#include "chip.h"
+#include <fsp/api.h>
/* Supplied by i2c.c */
extern struct device_operations picasso_i2c_mmio_ops;
@@ -117,6 +118,8 @@
static void soc_init(void *chip_info)
{
+ fsp_silicon_init(acpi_is_wakeup_s3());
+
southbridge_init(chip_info);
setup_bsp_ramtop();
}
diff --git a/src/soc/amd/picasso/reset.c b/src/soc/amd/picasso/reset.c
index 9841038..03cf306 100644
--- a/src/soc/amd/picasso/reset.c
+++ b/src/soc/amd/picasso/reset.c
@@ -22,6 +22,7 @@
#include <soc/southbridge.h>
#include <amdblocks/acpimmio.h>
#include <amdblocks/reset.h>
+#include <fsp/util.h>
void set_warm_reset_flag(void)
{
@@ -56,3 +57,17 @@
/* TODO: Would a warm_reset() suffice? */
do_cold_reset();
}
+
+void chipset_handle_reset(uint32_t status)
+{
+ switch (status) {
+ case FSP_STATUS_RESET_REQUIRED_3: /* Global Reset */
+ printk(BIOS_DEBUG, "GLOBAL RESET!!\n");
+ do_cold_reset();
+ break;
+ default:
+ printk(BIOS_ERR, "unhandled reset type %x\n", status);
+ die("unknown reset type");
+ break;
+ }
+}
diff --git a/src/soc/amd/picasso/romstage.c b/src/soc/amd/picasso/romstage.c
index da4ed8d..2b2813d 100644
--- a/src/soc/amd/picasso/romstage.c
+++ b/src/soc/amd/picasso/romstage.c
@@ -37,6 +37,7 @@
#include <soc/northbridge.h>
#include <soc/southbridge.h>
#include <soc/romstage.h>
+#include <fsp/api.h>
__weak void romstage_mainboard_early_init(void) {}
__weak void romstage_mainboard_init(int s3_resume) {}
@@ -80,6 +81,11 @@
timestamp_add(TS_START_ROMSTAGE, stage_start);
}
+void platform_fsp_memory_init_params_cb(FSPM_UPD *mupd, uint32_t version)
+{
+ // dummy
+}
+
asmlinkage void car_stage_entry(void)
{
struct postcar_frame pcf;
@@ -137,27 +143,26 @@
boot_count_increment();
post_code(0x49);
+
+ /* fsp_memory_init() requires cbmem_top() before returning. Use TOM.
+ * todo: verify TOM < UMA region when UMA is below 4GB */
msr_t tom = rdmsr(TOP_MEM);
tom.lo &= ~0xffffff;
backup_top_of_low_cacheable(tom.lo);
- post_code(0x4a);
- if (cbmem_recovery(s3_resume))
- printk(BIOS_CRIT, "Failed to recover cbmem\n");
- if (romstage_handoff_init(s3_resume))
- printk(BIOS_ERR, "Failed to set romstage handoff data\n");
+ fsp_memory_init(s3_resume);
- post_code(0x4b);
+ post_code(0x4a);
if (postcar_frame_init(&pcf, 1 * KiB))
die("Unable to initialize postcar frame.\n");
/*
* We need to make sure ramstage will be run cached. At this point exact
* location of ramstage in cbmem is not known. Instruct postcar to cache
- * 16 megs under cbmem top which is a safe bet to cover ramstage.
+ * 32 megs under cbmem top which is a safe bet to cover ramstage.
*/
top_of_ram = (uintptr_t) cbmem_top();
- postcar_frame_add_mtrr(&pcf, top_of_ram - 16*MiB, 16*MiB,
+ postcar_frame_add_mtrr(&pcf, top_of_ram - 32*MiB, 32*MiB,
MTRR_TYPE_WRBACK);
/* Cache the memory-mapped boot media. */
@@ -174,7 +179,7 @@
tseg_base = (uintptr_t)smm_base;
postcar_frame_add_mtrr(&pcf, tseg_base, smm_size, MTRR_TYPE_WRBACK);
- post_code(0x4c);
+ post_code(0x4b);
run_postcar_phase(&pcf);
post_code(0x50); /* Should never see this post code. */
--
To view, visit https://review.coreboot.org/c/coreboot/+/34423
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Iecb3a3f2599a8ccbc168b1d26a0271f51b71dcf0
Gerrit-Change-Number: 34423
Gerrit-PatchSet: 1
Gerrit-Owner: Marshall Dawson <marshalldawson3rd(a)gmail.com>
Gerrit-Reviewer: Furquan Shaikh <furquan(a)google.com>
Gerrit-Reviewer: Martin Roth <martinroth(a)google.com>
Gerrit-MessageType: newchange
Felix Singer has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/31086
Change subject: payloads/ipxe: Enable HTTPS support
......................................................................
payloads/ipxe: Enable HTTPS support
HTTPS needs a newer iPXE version than 2017.3,
because it doesn't work with this release.
Tested under master branch.
Change-Id: Ia25d4ce9260fa8c00fdea0e19f5e927559371af0
Signed-off-by: Felix Singer <migy(a)darmstadt.ccc.de>
---
M payloads/external/iPXE/Makefile
1 file changed, 1 insertion(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/86/31086/1
diff --git a/payloads/external/iPXE/Makefile b/payloads/external/iPXE/Makefile
index a8b1245..05b6f4dd 100644
--- a/payloads/external/iPXE/Makefile
+++ b/payloads/external/iPXE/Makefile
@@ -54,6 +54,7 @@
sed 's|#define\s*COMCONSOLE.*|#define COMCONSOLE $(IPXE_UART)|' "$(project_dir)/src/config/serial.h" > "$(project_dir)/src/config/serial.h.tmp"
sed 's|#define\s*COMSPEED.*|#define COMSPEED $(CONFIG_TTYS0_BAUD)|' "$(project_dir)/src/config/serial.h.tmp" > "$(project_dir)/src/config/serial.h"
endif
+ sed -ie 's|.*DOWNLOAD_PROTO_HTTPS|#define DOWNLOAD_PROTO_HTTPS|g' "$(project_dir)/src/config/general.h"
build: config
echo " MAKE $(project_name) $(TAG-y)"
--
To view, visit https://review.coreboot.org/c/coreboot/+/31086
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ia25d4ce9260fa8c00fdea0e19f5e927559371af0
Gerrit-Change-Number: 31086
Gerrit-PatchSet: 1
Gerrit-Owner: Felix Singer <migy(a)darmstadt.ccc.de>
Gerrit-MessageType: newchange
Kyösti Mälkki has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/35035 )
Change subject: [WIP] arch/x86: Add linker script for early DRAM
......................................................................
[WIP] arch/x86: Add linker script for early DRAM
Change-Id: I9c084ff6fdcf7e9154436f038705e8679daea780
Signed-off-by: Kyösti Mälkki <kyosti.malkki(a)gmail.com>
---
A src/arch/x86/early_dram.ld
1 file changed, 50 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/35/35035/1
diff --git a/src/arch/x86/early_dram.ld b/src/arch/x86/early_dram.ld
new file mode 100644
index 0000000..24b9551
--- /dev/null
+++ b/src/arch/x86/early_dram.ld
@@ -0,0 +1,50 @@
+/*
+ * This file is part of the coreboot project.
+ *
+ * Copyright (C) 2006 Advanced Micro Devices, Inc.
+ * Copyright (C) 2008-2010 coresystems GmbH
+ * Copyright 2015 Google Inc
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+
+/* This file is included inside a SECTIONS block */
+. = CONFIG_DCACHE_RAM_BASE;
+.car.data . (NOLOAD) : {
+ _car_region_start = . ;
+
+ /* Stack for CAR stages. Since it persists across all stages that
+ * use CAR it can be reused. The chipset/SoC is expected to provide
+ * the stack size. */
+#if CONFIG(C_ENVIRONMENT_BOOTBLOCK)
+ _car_stack_start = .;
+ . += CONFIG_DCACHE_BSP_STACK_SIZE;
+ _car_stack_end = .;
+#endif
+ /* The pre-ram cbmem console as well as the timestamp region are fixed
+ * in size. Therefore place them above the car global section so that
+ * multiple stages (romstage and verstage) have a consistent
+ * link address of these shared objects. */
+ PRERAM_CBMEM_CONSOLE(., CONFIG_PRERAM_CBMEM_CONSOLE_SIZE)
+
+ TIMESTAMP(., 0x200)
+
+ _car_ehci_dbg_info_start = .;
+ /* Reserve sizeof(struct ehci_dbg_info). */
+ . += 80;
+ _car_ehci_dbg_info_end = .;
+
+ _car_region_end = . + CONFIG_DCACHE_RAM_SIZE - (. - _car_region_start);
+}
+
+_bogus = ASSERT((CONFIG_DCACHE_RAM_SIZE == 0) || (SIZEOF(.car.data) <= CONFIG_DCACHE_RAM_SIZE), "Cache as RAM area is too full");
+#if !CONFIG(CAR_GLOBAL_MIGRATION)
+_bogus3 = ASSERT(CONFIG_DCACHE_BSP_STACK_SIZE > 0x0, "BSP stack size not configured");
+#endif
--
To view, visit https://review.coreboot.org/c/coreboot/+/35035
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I9c084ff6fdcf7e9154436f038705e8679daea780
Gerrit-Change-Number: 35035
Gerrit-PatchSet: 1
Gerrit-Owner: Kyösti Mälkki <kyosti.malkki(a)gmail.com>
Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org>
Gerrit-Reviewer: Kyösti Mälkki <kyosti.malkki(a)gmail.com>
Gerrit-MessageType: newchange
Patrick Rudolph has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/32705
Change subject: security/lockdown: Write-protect WP_RO
......................................................................
security/lockdown: Write-protect WP_RO
Add another choice to boot media protection and write-protect WP_RO
in case VBOOT is enabled.
Tested on Lenovo T520:
The WP_RO region is write-protected.
Change-Id: I72c3e1a0720514b9b85b0433944ab5fb7109b2a2
Signed-off-by: Patrick Rudolph <patrick.rudolph(a)9elements.com>
---
M src/security/lockdown/Kconfig
M src/security/lockdown/bootmedia.c
2 files changed, 29 insertions(+), 1 deletion(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/05/32705/1
diff --git a/src/security/lockdown/Kconfig b/src/security/lockdown/Kconfig
index bb4d072..1e982d8 100644
--- a/src/security/lockdown/Kconfig
+++ b/src/security/lockdown/Kconfig
@@ -15,6 +15,18 @@
config BOOTMEDIA_LOCK_NONE
bool "Don't lock boot media sections"
+config BOOTMEDIA_LOCK_VBOOT_RO
+ bool "Write-protect WP_RO region in boot media"
+ depends on VBOOT
+ help
+ Select this if you want to write-protect the WP_RO region as specified
+ in the VBOOT FMAP. You will only be able to write the regions
+ FW_MAIN_A/FW_MAIN_B, which are not write-protected using the internal
+ programmer.
+ The locking will take place during the chipset lockdown, which
+ is either triggered by coreboot (when INTEL_CHIPSET_LOCKDOWN is set)
+ or has to be triggered later (e.g. by the payload or the OS).
+
config BOOTMEDIA_LOCK_RO
bool "Write-protect the whole boot media"
help
diff --git a/src/security/lockdown/bootmedia.c b/src/security/lockdown/bootmedia.c
index 8fb4ae9..6fa2de2 100644
--- a/src/security/lockdown/bootmedia.c
+++ b/src/security/lockdown/bootmedia.c
@@ -17,6 +17,7 @@
#include <commonlib/region.h>
#include <console/console.h>
#include <bootstate.h>
+#include <fmap.h>
/*
* Enable write protection on the WP_RO region of the bootmedia.
@@ -47,8 +48,23 @@
"of whole bootmedia\n");
locked = true;
}
- }
+ } else if (CONFIG(BOOTMEDIA_LOCK_VBOOT_RO)) {
+ struct region_device dev;
+ if (fmap_locate_area_as_rdev("WP_RO", &dev) < 0) {
+ printk(BIOS_ERR, "BM-LOCKDOWN: Could not find region 'WP_RO'\n");
+ } else {
+ for (size_t i = 0; i < ARRAY_SIZE(wp_prot); i++) {
+ printk(BIOS_DEBUG, "BM-LOCKDOWN: Trying write-protection"
+ "#%zu ...\n", i);
+ if (boot_device_wp_region(&dev, wp_prot[i]) < 0)
+ continue;
+ printk(BIOS_INFO, "BM-LOCKDOWN: Enabled write-protection of"
+ "WP_RO region\n");
+ locked = true;
+ }
+ }
+ }
if (!locked)
printk(BIOS_INFO, "BM-LOCKDOWN: Didn't enable bootmedia protection\n");
}
--
To view, visit https://review.coreboot.org/c/coreboot/+/32705
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I72c3e1a0720514b9b85b0433944ab5fb7109b2a2
Gerrit-Change-Number: 32705
Gerrit-PatchSet: 1
Gerrit-Owner: Patrick Rudolph <patrick.rudolph(a)9elements.com>
Gerrit-MessageType: newchange
Patrick Rudolph has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/32704
Change subject: security: Add common boot media write protection
......................................................................
security: Add common boot media write protection
Introduce boot media protection settings and use the existing
boot_device_wp_region() function to apply settings on all
platforms that supports it yet.
Also remove the Intel southbridge code, which is now obsolete.
Tested on Lenovo T520. The whole flash is protected.
Change-Id: Iceb3ecf0bde5cec562bc62d1d5c79da35305d183
Signed-off-by: Patrick Rudolph <patrick.rudolph(a)9elements.com>
---
M src/security/Kconfig
M src/security/Makefile.inc
A src/security/lockdown/Kconfig
A src/security/lockdown/Makefile.inc
A src/security/lockdown/bootmedia.c
M src/soc/intel/common/block/fast_spi/Kconfig
M src/southbridge/intel/common/Kconfig
M src/southbridge/intel/common/finalize.c
8 files changed, 124 insertions(+), 49 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/04/32704/1
diff --git a/src/security/Kconfig b/src/security/Kconfig
index 6a334ac..99cb054 100644
--- a/src/security/Kconfig
+++ b/src/security/Kconfig
@@ -14,3 +14,4 @@
source "src/security/vboot/Kconfig"
source "src/security/tpm/Kconfig"
+source "src/security/lockdown/Kconfig"
diff --git a/src/security/Makefile.inc b/src/security/Makefile.inc
index a940b82..a74e498 100644
--- a/src/security/Makefile.inc
+++ b/src/security/Makefile.inc
@@ -1,2 +1,3 @@
subdirs-y += vboot
subdirs-y += tpm
+subdirs-y += lockdown
diff --git a/src/security/lockdown/Kconfig b/src/security/lockdown/Kconfig
new file mode 100644
index 0000000..bb4d072
--- /dev/null
+++ b/src/security/lockdown/Kconfig
@@ -0,0 +1,46 @@
+
+config SECURITY_BOOTMEDIA_LOCKDOWN
+ bool
+ default n
+ help
+ Platform support the locking of boot media. This can be for example
+ SPI controller protected regions or flash status register locking.
+
+if SECURITY_BOOTMEDIA_LOCKDOWN
+
+choice
+ prompt "Boot media protection"
+ default BOOTMEDIA_LOCK_NONE
+
+config BOOTMEDIA_LOCK_NONE
+ bool "Don't lock boot media sections"
+
+config BOOTMEDIA_LOCK_RO
+ bool "Write-protect the whole boot media"
+ help
+ Select this if you want to write-protect the whole firmware boot
+ media. The locking will take place during the chipset lockdown, which
+ is either triggered by coreboot (when INTEL_CHIPSET_LOCKDOWN is set)
+ or has to be triggered later (e.g. by the payload or the OS).
+
+ NOTE: If you trigger the chipset lockdown unconditionally,
+ you won't be able to write to the flash chip using the
+ internal programmer any more.
+
+config BOOTMEDIA_LOCK_NO_ACCESS
+ bool "Read- and write-protect the whole boot media"
+ help
+ Select this if you want to protect the firmware boot media against
+ all further accesses. On platforms that memory map a part of the
+ boot media the corresponding region is still readable.
+ The locking will take place during the chipset lockdown, which is
+ either triggered by coreboot (when INTEL_CHIPSET_LOCKDOWN is set) or
+ has to be triggered later (e.g. by the payload or the OS).
+
+ NOTE: If you trigger the chipset lockdown unconditionally,
+ you won't be able to write to the boot media using the
+ internal programmer any more.
+
+endchoice
+
+endif
diff --git a/src/security/lockdown/Makefile.inc b/src/security/lockdown/Makefile.inc
new file mode 100644
index 0000000..c287b9b
--- /dev/null
+++ b/src/security/lockdown/Makefile.inc
@@ -0,0 +1,16 @@
+##
+## This file is part of the coreboot project.
+##
+## Copyright (C) 2019 9elements Agency GmbH <patrick.rudolph(a)9elements.com>
+##
+## This program is free software; you can redistribute it and/or modify
+## it under the terms of the GNU General Public License as published by
+## the Free Software Foundation; version 2 of the License.
+##
+## This program is distributed in the hope that it will be useful,
+## but WITHOUT ANY WARRANTY; without even the implied warranty of
+## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+## GNU General Public License for more details.
+##
+
+ramstage-$(CONFIG_SECURITY_BOOTMEDIA_LOCKDOWN) += bootmedia.c
diff --git a/src/security/lockdown/bootmedia.c b/src/security/lockdown/bootmedia.c
new file mode 100644
index 0000000..8fb4ae9
--- /dev/null
+++ b/src/security/lockdown/bootmedia.c
@@ -0,0 +1,58 @@
+/*
+ * This file is part of the coreboot project.
+ *
+ * Copyright (C) 2019 9elements Agency GmbH <patrick.rudolph(a)9elements.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+
+#include <boot_device.h>
+#include <commonlib/region.h>
+#include <console/console.h>
+#include <bootstate.h>
+
+/*
+ * Enable write protection on the WP_RO region of the bootmedia.
+ */
+static void security_lockdown_bootmedia(void *unused)
+{
+ static const int wp_prot[] = {MEDIA_WP, CTRLR_WP};
+ const struct region_device *rdev;
+ bool locked = false;
+
+ if (CONFIG(BOOTMEDIA_LOCK_RO)) {
+ rdev = boot_device_ro();
+
+ for (size_t i = 0; i < ARRAY_SIZE(wp_prot); i++) {
+ printk(BIOS_DEBUG, "BM-LOCKDOWN: Trying write-protection"
+ "#%zu ...\n", i);
+ if (boot_device_wp_region(rdev, wp_prot[i]) < 0)
+ continue;
+
+ printk(BIOS_INFO, "BM-LOCKDOWN: Enabled write-protection of"
+ "whole bootmedia\n");
+ locked = true;
+ }
+ } else if (CONFIG(BOOTMEDIA_LOCK_NO_ACCESS)) {
+ rdev = boot_device_ro();
+ if (boot_device_wp_region(rdev, CTRLR_RWP) == 0) {
+ printk(BIOS_INFO, "BM-LOCKDOWN: Enabled read- and write protection"
+ "of whole bootmedia\n");
+ locked = true;
+ }
+ }
+
+ if (!locked)
+ printk(BIOS_INFO, "BM-LOCKDOWN: Didn't enable bootmedia protection\n");
+}
+
+/* BS_POST_DEVICE will lock the hardware */
+BOOT_STATE_INIT_ENTRY(BS_DEV_INIT, BS_ON_EXIT, security_lockdown_bootmedia,
+ NULL);
diff --git a/src/soc/intel/common/block/fast_spi/Kconfig b/src/soc/intel/common/block/fast_spi/Kconfig
index 4bd1f59..ff02844 100644
--- a/src/soc/intel/common/block/fast_spi/Kconfig
+++ b/src/soc/intel/common/block/fast_spi/Kconfig
@@ -1,5 +1,6 @@
config SOC_INTEL_COMMON_BLOCK_FAST_SPI
bool
+ select SECURITY_BOOTMEDIA_LOCKDOWN
help
Intel Processor common FAST_SPI support
diff --git a/src/southbridge/intel/common/Kconfig b/src/southbridge/intel/common/Kconfig
index c3bd90d..39234a8 100644
--- a/src/southbridge/intel/common/Kconfig
+++ b/src/southbridge/intel/common/Kconfig
@@ -20,6 +20,7 @@
config SOUTHBRIDGE_INTEL_COMMON_SPI
def_bool n
select SPI_FLASH
+ select SECURITY_BOOTMEDIA_LOCKDOWN
config SOUTHBRIDGE_INTEL_COMMON_PIRQ_ACPI_GEN
def_bool n
@@ -68,42 +69,3 @@
config SOUTHBRIDGE_INTEL_COMMON_WATCHDOG
bool
depends on SOUTHBRIDGE_INTEL_COMMON
-
-if SOUTHBRIDGE_INTEL_COMMON_FINALIZE
-
-choice
- prompt "Flash locking during chipset lockdown"
- default LOCK_SPI_FLASH_NONE
-
-config LOCK_SPI_FLASH_NONE
- bool "Don't lock flash sections"
-
-config LOCK_SPI_FLASH_RO
- bool "Write-protect all flash sections"
- help
- Select this if you want to write-protect the whole firmware flash
- chip. The locking will take place during the chipset lockdown, which
- is either triggered by coreboot (when INTEL_CHIPSET_LOCKDOWN is set)
- or has to be triggered later (e.g. by the payload or the OS).
-
- NOTE: If you trigger the chipset lockdown unconditionally,
- you won't be able to write to the flash chip using the
- internal programmer any more.
-
-config LOCK_SPI_FLASH_NO_ACCESS
- bool "Write-protect all flash sections and read-protect non-BIOS sections"
- help
- Select this if you want to protect the firmware flash against all
- further accesses (with the exception of the memory mapped BIOS re-
- gion which is always readable). The locking will take place during
- the chipset lockdown, which is either triggered by coreboot (when
- INTEL_CHIPSET_LOCKDOWN is set) or has to be triggered later (e.g.
- by the payload or the OS).
-
- NOTE: If you trigger the chipset lockdown unconditionally,
- you won't be able to write to the flash chip using the
- internal programmer any more.
-
-endchoice
-
-endif
diff --git a/src/southbridge/intel/common/finalize.c b/src/southbridge/intel/common/finalize.c
index 80c65bb..6f7934a 100644
--- a/src/southbridge/intel/common/finalize.c
+++ b/src/southbridge/intel/common/finalize.c
@@ -28,16 +28,6 @@
{
const pci_devfn_t lpc_dev = PCI_DEV(0, 0x1f, 0);
- if (CONFIG(LOCK_SPI_FLASH_RO) ||
- CONFIG(LOCK_SPI_FLASH_NO_ACCESS)) {
- int i;
- u32 lockmask = 1UL << 31;
- if (CONFIG(LOCK_SPI_FLASH_NO_ACCESS))
- lockmask |= 1 << 15;
- for (i = 0; i < 20; i += 4)
- RCBA32(0x3874 + i) = RCBA32(0x3854 + i) | lockmask;
- }
-
/* Lock SPIBAR */
RCBA32_OR(0x3804, (1 << 15));
--
To view, visit https://review.coreboot.org/c/coreboot/+/32704
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Iceb3ecf0bde5cec562bc62d1d5c79da35305d183
Gerrit-Change-Number: 32704
Gerrit-PatchSet: 1
Gerrit-Owner: Patrick Rudolph <patrick.rudolph(a)9elements.com>
Gerrit-Reviewer: Martin Roth <martinroth(a)google.com>
Gerrit-Reviewer: Patrick Georgi <pgeorgi(a)google.com>
Gerrit-Reviewer: Patrick Rudolph <patrick.rudolph(a)9elements.com>
Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org>
Gerrit-MessageType: newchange
Hello Nico Huber,
I'd like you to do a code review. Please visit
https://review.coreboot.org/c/coreboot/+/31351
to review the following change.
Change subject: soc/intel/apl: Add chip.h setting for PCIe ASPM
......................................................................
soc/intel/apl: Add chip.h setting for PCIe ASPM
We don't use a direct mapping to the UPD values so we don't have to set
it to the default `auto` in all devicetrees.
Change-Id: I169722c3c63be66772cb57a429ec7b83230fa234
Signed-off-by: Nico Huber <nico.huber(a)secunet.com>
---
M src/soc/intel/apollolake/chip.c
M src/soc/intel/apollolake/chip.h
2 files changed, 18 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/51/31351/1
diff --git a/src/soc/intel/apollolake/chip.c b/src/soc/intel/apollolake/chip.c
index 3634509..cfe8d4a 100644
--- a/src/soc/intel/apollolake/chip.c
+++ b/src/soc/intel/apollolake/chip.c
@@ -669,6 +669,7 @@
{
FSP_S_CONFIG *silconfig = &silupd->FspsConfig;
static struct soc_intel_apollolake_config *cfg;
+ int i;
/* Load VBT before devicetree-specific config. */
silconfig->GraphicsConfigPtr = (uintptr_t)vbt_get();
@@ -693,6 +694,11 @@
memcpy(silconfig->PcieRpHotPlug, cfg->pcie_rp_hotplug_enable,
sizeof(silconfig->PcieRpHotPlug));
+ for (i = 0; i < ARRAY_SIZE(silconfig->PcieRpAspm); ++i) {
+ if (cfg->pcie_rp_aspm[i] != ASPM_IGNORE)
+ silconfig->PcieRpAspm[i] = cfg->pcie_rp_aspm[i] - 1;
+ }
+
switch (cfg->serirq_mode) {
case SERIRQ_QUIET:
silconfig->SirqEnable = 1;
diff --git a/src/soc/intel/apollolake/chip.h b/src/soc/intel/apollolake/chip.h
index b9e368c..b8f9f8c 100644
--- a/src/soc/intel/apollolake/chip.h
+++ b/src/soc/intel/apollolake/chip.h
@@ -57,6 +57,18 @@
/* De-emphasis enable configuration for each PCIe root port */
uint8_t pcie_rp_deemphasis_enable[MAX_PCIE_PORTS];
+ /* ASPM enable setting for each PCIe root port */
+ enum {
+ ASPM_IGNORE = 0,
+ /* Enumeration values below are off-by-one compared to the
+ UPD to have the default 0 ignore the devicetree setting: */
+ ASPM_DISABLED,
+ ASPM_L0S,
+ ASPM_L1,
+ ASPM_L0SL1,
+ ASPM_AUTO,
+ } pcie_rp_aspm[MAX_PCIE_PORTS];
+
/* [14:8] DDR mode Number of dealy elements.Each = 125pSec.
* [6:0] SDR mode Number of dealy elements.Each = 125pSec.
*/
--
To view, visit https://review.coreboot.org/c/coreboot/+/31351
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I169722c3c63be66772cb57a429ec7b83230fa234
Gerrit-Change-Number: 31351
Gerrit-PatchSet: 1
Gerrit-Owner: Thomas Heijligen <src(a)posteo.de>
Gerrit-Reviewer: Nico Huber <nico.h(a)gmx.de>
Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org>
Gerrit-Reviewer: Thomas Heijligen <src(a)posteo.de>
Gerrit-MessageType: newchange
Mike Banon has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/33919
Change subject: src/mainboard/asus/am1i-a/buildOpts.c: set a board type to AMD_PLATFORM_DESKTOP
......................................................................
src/mainboard/asus/am1i-a/buildOpts.c: set a board type to AMD_PLATFORM_DESKTOP
Original AMD_PLATFORM_MOBILE is incorrect because this board is a desktop one.
Signed-off-by: Mike Banon <mikebdp2(a)gmail.com>
Change-Id: I02adedffe8624c38e7b93fadd0449ddf094388fd
---
M src/mainboard/asus/am1i-a/buildOpts.c
1 file changed, 1 insertion(+), 1 deletion(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/19/33919/1
diff --git a/src/mainboard/asus/am1i-a/buildOpts.c b/src/mainboard/asus/am1i-a/buildOpts.c
index cba0894..98bc620 100644
--- a/src/mainboard/asus/am1i-a/buildOpts.c
+++ b/src/mainboard/asus/am1i-a/buildOpts.c
@@ -115,7 +115,7 @@
#define BLDCFG_CORE_LEVELING_MODE CORE_LEVEL_LOWEST
#define BLDCFG_MEM_INIT_PSTATE 0
-#define BLDCFG_AMD_PLATFORM_TYPE AMD_PLATFORM_MOBILE
+#define BLDCFG_AMD_PLATFORM_TYPE AMD_PLATFORM_DESKTOP
#define BLDCFG_MEMORY_BUS_FREQUENCY_LIMIT DDR1600_FREQUENCY
#define BLDCFG_MEMORY_MODE_UNGANGED TRUE
--
To view, visit https://review.coreboot.org/c/coreboot/+/33919
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I02adedffe8624c38e7b93fadd0449ddf094388fd
Gerrit-Change-Number: 33919
Gerrit-PatchSet: 1
Gerrit-Owner: Mike Banon <mikebdp2(a)gmail.com>
Gerrit-MessageType: newchange