Michał Żygowski has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/43392 )
Change subject: security/intel: add Boot Guard menu
......................................................................
security/intel: add Boot Guard menu
Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Change-Id: I8630c28643e3cb098eb6e544eb4b64bb1527582c
---
M src/security/intel/Kconfig
A src/security/intel/bootguard/Kconfig
2 files changed, 104 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/92/43392/1
diff --git a/src/security/intel/Kconfig b/src/security/intel/Kconfig
index 9cdd8a6..69aed6b 100644
--- a/src/security/intel/Kconfig
+++ b/src/security/intel/Kconfig
@@ -2,3 +2,5 @@
source "src/security/intel/txt/Kconfig"
source "src/security/intel/stm/Kconfig"
+source "src/security/intel/bootguard/Kconfig"
+
diff --git a/src/security/intel/bootguard/Kconfig b/src/security/intel/bootguard/Kconfig
new file mode 100644
index 0000000..ebaf386
--- /dev/null
+++ b/src/security/intel/bootguard/Kconfig
@@ -0,0 +1,102 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+config INTEL_BOOTGUARD
+ bool "Intel Boot Guard"
+ depends on CPU_INTEL_FIRMWARE_INTERFACE_TABLE
+ default n
+
+if INTEL_BOOTGUARD
+
+menu "Boot Guard"
+
+choice
+ prompt "Key Manifest source"
+ default KM_EXISTING
+
+config KM_EXISTING
+ bool "Use existing Key Manifest"
+
+config KM_BUILD
+ bool "Build Key Manifest from OEM root key"
+
+endchoice
+
+config KM_PRIV_KEY
+ string "Path to private RSA key for Key Manifest"
+ depends on KM_BUILD
+ default "OEM_root_key_private.pem"
+
+config KM_PM_VERSION
+ int "Platform Manufacturer's Key Manifest Version"
+ depends on KM_BUILD
+ default 0
+ help
+ OEM-defined version number, not used by Boot Guard.
+
+
+config KM_KEY_ID
+ int "Key ID (1-15, must be the same as in ME)"
+ depends on KM_BUILD
+ default 15
+
+config KM_SVN
+ int "Key Manifest Revocation Value (use with care)"
+ depends on KM_BUILD
+ default 0
+ help
+ This value will be compared with value saved in FPF. If this value
+ is higher, the FPF will be updated. If it is lower, KM will be
+ revoked. Saturates at 15, no more revocations will be possible.
+ You have been warned.
+
+config KM_FILE
+ string
+ prompt "Path to pre-built Key Manifest" if KM_EXISTING
+ default "key_manifest.bin"
+
+config BPM_PRIV_KEY
+ string "Path to private RSA key for Boot Policy Manifest"
+ default "BPM_key_private.pem"
+
+config BPM_FILE
+ string
+ default "boot_policy_manifest.bin"
+
+config BPM_PM_VERSION
+ int "Platform Manufacturer's Boot Policy Version"
+ default 0
+ help
+ OEM-defined version number, not used by Boot Guard.
+
+config BPM_SVN
+ int "Boot Policy Revocation Value (use with care)"
+ default 0
+ help
+ This value will be compared with value saved in FPF. If this value
+ is higher, the FPF will be updated. If it is lower, BPM will be
+ revoked. Saturates at 15, no more revocations will be possible.
+ You have been warned.
+
+config ACM_SVN
+ int "ACM Revocation Value (use with care)"
+ default 2
+ help
+ This value will be compared with value saved in FPF. If this value
+ is higher and the same as the one saved in ACM, the FPF will be
+ updated. If it is lower, ACM will be revoked. Values lower than 2
+ are reserved for development versions of ACM. All ACMs with their
+ internal SVN higher than the one in FPF will be authorized, so this
+ value doesn't need to be bumped for newer ACMs. Saturates at 15, no
+ more revocations will be possible.
+ You have been warned.
+
+config BTG_ACM_FILE
+ string "Path and filename of the Boot Guard ACM"
+ default ""
+ help
+ Include the Boot Guard Authenticated Code Module necessary to boot
+ Boot Guard enabled platform
+
+endmenu
+
+endif
--
To view, visit https://review.coreboot.org/c/coreboot/+/43392
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I8630c28643e3cb098eb6e544eb4b64bb1527582c
Gerrit-Change-Number: 43392
Gerrit-PatchSet: 1
Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Gerrit-MessageType: newchange
Michał Żygowski has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/43397 )
Change subject: soc/intel/skylake: Add necessary FSPT params when FSP CAR is used
......................................................................
soc/intel/skylake: Add necessary FSPT params when FSP CAR is used
Without these parameters the build with FSP CAR enabled will fail,
unless a board implement the parameters.
Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Change-Id: I7b3f770bd56ca072bebb485c02e1022ba95c6e4c
---
M src/soc/intel/skylake/Makefile.inc
A src/soc/intel/skylake/bootblock/fspcar.c
2 files changed, 30 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/97/43397/1
diff --git a/src/soc/intel/skylake/Makefile.inc b/src/soc/intel/skylake/Makefile.inc
index 75121ab..842f582 100644
--- a/src/soc/intel/skylake/Makefile.inc
+++ b/src/soc/intel/skylake/Makefile.inc
@@ -10,6 +10,7 @@
subdirs-y += ../../../cpu/x86/smm
subdirs-y += ../../../cpu/x86/tsc
+bootblock-$(CONFIG_FSP_CAR) += bootblock/fspcar.c
bootblock-y += bootblock/bootblock.c
bootblock-y += bootblock/cpu.c
bootblock-y += i2c.c
diff --git a/src/soc/intel/skylake/bootblock/fspcar.c b/src/soc/intel/skylake/bootblock/fspcar.c
new file mode 100644
index 0000000..b2580c4
--- /dev/null
+++ b/src/soc/intel/skylake/bootblock/fspcar.c
@@ -0,0 +1,29 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+#include <stdint.h>
+#include <FsptUpd.h>
+
+const FSPT_UPD temp_ram_init_params = {
+ .FspUpdHeader = {
+ .Signature = 0x545F4450554C424BULL, /* 'KBLUPD_T' */
+ .Revision = 1,
+ .Reserved = {0},
+ },
+ .FsptCoreUpd = {
+ /*
+ * It is a requirement for firmware to have Firmware Interface Table
+ * (FIT), which contains pointers to each microcode update.
+ * The microcode update is loaded for all logical processors before
+ * cpu reset vector.
+ *
+ * All SoC since Gen-4 has above mechanism in place to load microcode
+ * even before hitting CPU reset vector. Hence skipping FSP-T loading
+ * microcode after CPU reset by passing '0' value to
+ * FSPT_UPD.MicrocodeRegionBase and FSPT_UPD.MicrocodeRegionSize.
+ */
+ .MicrocodeRegionBase = 0,
+ .MicrocodeRegionSize = 0,
+ .CodeRegionBase = (uint32_t)(0x100000000ULL - CONFIG_ROM_SIZE),
+ .CodeRegionSize = (uint32_t)CONFIG_ROM_SIZE,
+ },
+};
--
To view, visit https://review.coreboot.org/c/coreboot/+/43397
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I7b3f770bd56ca072bebb485c02e1022ba95c6e4c
Gerrit-Change-Number: 43397
Gerrit-PatchSet: 1
Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Gerrit-Reviewer: Martin Roth <martinroth(a)google.com>
Gerrit-Reviewer: Patrick Georgi <pgeorgi(a)google.com>
Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org>
Gerrit-MessageType: newchange
Michał Żygowski has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/43396 )
Change subject: soc/intel/skylake/Kconfig: Select FSPT XIP in FSP CAR is used
......................................................................
soc/intel/skylake/Kconfig: Select FSPT XIP in FSP CAR is used
Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Change-Id: Ic7c984c6e2c0f93cbb97a7aa8426c2f6ef889162
---
M src/soc/intel/skylake/Kconfig
1 file changed, 1 insertion(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/96/43396/1
diff --git a/src/soc/intel/skylake/Kconfig b/src/soc/intel/skylake/Kconfig
index a3e8d9f..1f36c27 100644
--- a/src/soc/intel/skylake/Kconfig
+++ b/src/soc/intel/skylake/Kconfig
@@ -30,6 +30,7 @@
select CPU_INTEL_FIRMWARE_INTERFACE_TABLE
select CPU_INTEL_COMMON_HYPERTHREADING
select FSP_M_XIP
+ select FSP_T_XIP if FSP_CAR
select GENERIC_GPIO_LIB
select HAVE_FSP_GOP
select HAVE_FSP_LOGO_SUPPORT
--
To view, visit https://review.coreboot.org/c/coreboot/+/43396
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ic7c984c6e2c0f93cbb97a7aa8426c2f6ef889162
Gerrit-Change-Number: 43396
Gerrit-PatchSet: 1
Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com>
Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org>
Gerrit-MessageType: newchange
Paul Menzel has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/43574 )
Change subject: nb/intel/i945: Switch back from V4 to V3 resource allocator to fix hangs
......................................................................
nb/intel/i945: Switch back from V4 to V3 resource allocator to fix hangs
On the Lenovo T60 (TYPE 2007 with dedicated ATI/AMD graphics card) with the
resource allocator v4 the system 99 percent of the time hangs decompressing the
payload or a little later. coreboot runs the VGA Option ROM, as the GRUB
payload is used.
CBFS: Locating 'fallback/payload'
CBFS: Found @ offset 4d580 size 60f2c
Checking segment from ROM address 0xffe4d7b8
Checking segment from ROM address 0xffe4d7d4
Checking segment from ROM address 0xffe4d7f0
Loading segment from ROM address 0xffe4d7b8
code (compression=1)
New segment dstaddr 0x00009000 memsize 0x17858 srcaddr 0xffe4d80c filesize 0x833b
Loading Segment: addr: 0x00009000 memsz: 0x0000000000017858 filesz: 0x000000000000833b
using LZMA
Clearing Segment: addr: 0x0000000000018dc3 memsz: 0x0000000000007a95
Loading segment from ROM address 0xffe4d7d4
code (compression=1)
New segment dstaddr 0x00100000 memsize 0x11a6c0 srcaddr 0xffe55b47 filesize 0x58b9d
Loading Segment: addr: 0x00100000 memsz: 0x000000000011a6c0 filesz: 0x0000000000058b9d
using LZMA
Sometimes it halts also a little later.
CBFS: Locating 'fallback/payload'
CBFS: Found @ offset 4d580 size 60f2c
Checking segment from ROM address 0xffe4d7b8
Checking segment from ROM address 0xffe4d7d4
Checking segment from ROM address 0xffe4d7f0
Loading segment from ROM address 0xffe4d7b8
code (compression=1)
New segment dstaddr 0x00009000 memsize 0x17858 srcaddr 0xffe4d80c filesize 0x833b
Loading Segment: addr: 0x00009000 memsz: 0x0000000000017858 filesz: 0x000000000000833b
using LZMA
Clearing Segment: addr: 0x0000000000018dc3 memsz: 0x0000000000007a95
Loading segment from ROM address 0xffe4d7d4
code (compression=1)
New segment dstaddr 0x00100000 memsize 0x11a6c0 srcaddr 0xffe55b47 filesize 0x58b9d
Loading Segment: addr: 0x00100000 memsz: 0x000000000011a6c0 filesz: 0x0000000000058b9d
using LZMA
Loading segment from ROM address 0xffe4d7f0
Entry Point 0x00009000
BS: BS_PAYLOAD_LOAD run times (exec / console): 365 / 81 ms
ICH-NM10-PCH: watchdog disabled
Jumping to boot code at 0x00009000(0xbfb7e000)
A cursor in blinking on the top left corner.
Fixes: 23b874a374 (device: Switch to resource allocator v4 by default treewide)
Resolves: https://ticket.coreboot.org/issues/267
Change-Id: I1d8d60c26bfe036cbd769ef96b4873e1438adea8
Signed-off-by: Paul Menzel <pmenzel(a)molgen.mpg.de>
---
M src/northbridge/intel/i945/Kconfig
1 file changed, 1 insertion(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/74/43574/1
diff --git a/src/northbridge/intel/i945/Kconfig b/src/northbridge/intel/i945/Kconfig
index d6498f1..ea74a8f 100644
--- a/src/northbridge/intel/i945/Kconfig
+++ b/src/northbridge/intel/i945/Kconfig
@@ -2,6 +2,7 @@
config NORTHBRIDGE_INTEL_I945
bool
+ select RESOURCE_ALLOCATOR_V3
if NORTHBRIDGE_INTEL_I945
--
To view, visit https://review.coreboot.org/c/coreboot/+/43574
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I1d8d60c26bfe036cbd769ef96b4873e1438adea8
Gerrit-Change-Number: 43574
Gerrit-PatchSet: 1
Gerrit-Owner: Paul Menzel <paulepanter(a)users.sourceforge.net>
Gerrit-MessageType: newchange