Patrick Georgi has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/37150 )
Change subject: util/kconfig: Remove miniconfig script
......................................................................
util/kconfig: Remove miniconfig script
It replicates the functionality of savedefconfig because back when the
script was added, savedefconfig didn't work for us. It now does, is
the official way of doing things, is recommended in our documentation
and is also a fair bit faster.
Change-Id: Ia8e0377537ff7cd638c564037ea6a77b01a87243
Signed-off-by: Patrick Georgi <pgeorgi(a)google.com>
---
D util/kconfig/miniconfig
1 file changed, 0 insertions(+), 87 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/50/37150/1
diff --git a/util/kconfig/miniconfig b/util/kconfig/miniconfig
deleted file mode 100755
index 29a4035..0000000
--- a/util/kconfig/miniconfig
+++ /dev/null
@@ -1,87 +0,0 @@
-#!/usr/bin/env bash
-#
-# miniconfig - utility to minimize your coreboot config files
-#
-# Copyright 2015 Google Inc.
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; version 2 of the License.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-
-CONFIG=$1
-NEWCONFIG=$2
-
-CONF=build/util/kconfig/conf
-KCONFIG=src/Kconfig
-DOTCONFIG=.config
-PREVCONFIG=.config.prev
-TMPCONFIG=.config.mini
-
-recreate_config()
-{
- $CONF --olddefconfig $KCONFIG &> /dev/null
-}
-
-if [ "$CONFIG" == "" ]; then
- printf "usage: util/miniconfig/miniconfig [path to config file] <path to new config file>\n"
- exit 0
-fi
-
-if [ ! -r "$CONFIG" ]; then
- printf "Can't read $CONFIG.\n"
- exit 1
-fi
-
-if [ "$CONFIG" == .config ]; then
- printf "Can't use .config, it's overwritten. Make a backup.\n"
- exit 1
-fi
-
-if [ ! -x "$CONF" ]; then
- printf "conf utility at $CONF not available.\n"
- exit 1
-fi
-
-# Start out by creating a default config file for a mainboard
-VENDOR=$( grep ^CONFIG_VENDOR "$CONFIG" )
-BOARD=$( grep ^CONFIG_BOARD "$CONFIG" | grep -v ROMSIZE | grep -v SPECIFIC_OPTIONS )
-
-printf "$VENDOR\n$BOARD\n" > "$TMPCONFIG"
-cp "$TMPCONFIG" "$DOTCONFIG"
-recreate_config
-
-LINES=$( cat "$CONFIG" | wc -l )
-CUR=1
-
-# Now go through each line of the existing, large config file, add it to our
-# new minimal config file, and see if it makes a difference when running "make
-# olddefconfig". If it does, keep the line, otherwise discard it.
-
-cat "$CONFIG" | while read L; do
- printf "\rProcessing $CONFIG - $CUR / $LINES (%d%%)" $(( $CUR * 100 / $LINES))
- mv "$DOTCONFIG" "$PREVCONFIG"
- cp "$TMPCONFIG" "$DOTCONFIG"
- echo "$L" >> "$DOTCONFIG"
- recreate_config
-
- if ! diff -q "$DOTCONFIG" "$PREVCONFIG" > /dev/null; then
- echo "$L" >> "$TMPCONFIG"
- fi
- CUR=$(( $CUR + 1 ))
-done
-
-echo
-
-if [ "$NEWCONFIG" != "" ]; then
- printf "Writing new, minimized config to $NEWCONFIG\n"
- mv "$TMPCONFIG" "$NEWCONFIG"
-else
- printf "Overwriting $CONFIG with new, minimized config.\n"
- mv "$TMPCONFIG" "$CONFIG"
-fi
--
To view, visit https://review.coreboot.org/c/coreboot/+/37150
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ia8e0377537ff7cd638c564037ea6a77b01a87243
Gerrit-Change-Number: 37150
Gerrit-PatchSet: 1
Gerrit-Owner: Patrick Georgi <pgeorgi(a)google.com>
Gerrit-MessageType: newchange
Marshall Dawson has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/37490 )
Change subject: soc/amd/picasso: Add bootblock
......................................................................
soc/amd/picasso: Add bootblock
The original plan for Picasso was to always combine features of bootblock
with its romstage due to its unique way of coming out of reset. The arch
and cpu implementations for RESET_VECTOR_IN_RAM are simplified now,
allowing the option of running a more traditional bootblock, albeit in
system DRAM.
Create a new early.c file to contain the initial steps required,
regardless of whether the first stage is bootblock or eventually
romstage. Add bootblock files containing functions that lib/bootblock
expects. Modify Makefile.inc to automatically determine the BIOS image's
base and size.
Change-Id: I1d0784025f2b39f140b16f37726d4a7f36df6c6c
Signed-off-by: Marshall Dawson <marshalldawson3rd(a)gmail.com>
---
M src/soc/amd/picasso/Kconfig
M src/soc/amd/picasso/Makefile.inc
A src/soc/amd/picasso/bootblock/bootblock.c
A src/soc/amd/picasso/bootblock/pre_c.S
A src/soc/amd/picasso/early.c
A src/soc/amd/picasso/include/soc/early.h
6 files changed, 258 insertions(+), 19 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/90/37490/1
diff --git a/src/soc/amd/picasso/Kconfig b/src/soc/amd/picasso/Kconfig
index 56c7da7..cbee93d 100644
--- a/src/soc/amd/picasso/Kconfig
+++ b/src/soc/amd/picasso/Kconfig
@@ -26,6 +26,7 @@
select ARCH_VERSTAGE_X86_32
select ARCH_ROMSTAGE_X86_32
select ARCH_RAMSTAGE_X86_32
+ select RESET_VECTOR_IN_RAM
select X86_AMD_FIXED_MTRRS
select X86_AMD_INIT_SIPI
select ACPI_AMD_HARDWARE_SLEEP_VALUES
@@ -55,10 +56,6 @@
select SSE2
select RTC
-config HAVE_BOOTBLOCK
- bool
- default n
-
config PRERAM_CBMEM_CONSOLE_SIZE
hex
default 0x1600
@@ -213,6 +210,28 @@
menu "PSP Configuration Options"
+config X86_RESET_VECTOR
+ hex
+ default 0x807fff0
+
+config C_ENV_BOOTBLOCK_SIZE
+ hex
+ default 0x80000
+
+config EARLYRAM_BSP_STACK_SIZE
+ hex
+ default 0x800
+ help
+ The amount of stack allocated to the bootstrap core before ramstage.
+
+config RAM_RESET_VECTOR_STAGE_BSS_SIZE
+ hex
+ depends on RESET_VECTOR_IN_RAM
+ default 0x50000
+ help
+ A common region of DRAM is allocated for use as .bss for all
+ pre-ramstage stages.
+
config AMDFW_OUTSIDE_CBFS
bool "The AMD firmware is outside CBFS"
default n
diff --git a/src/soc/amd/picasso/Makefile.inc b/src/soc/amd/picasso/Makefile.inc
index 76a4d70..b0cce26 100644
--- a/src/soc/amd/picasso/Makefile.inc
+++ b/src/soc/amd/picasso/Makefile.inc
@@ -37,8 +37,19 @@
subdirs-y += ../../../cpu/x86/pae
subdirs-y += ../../../cpu/x86/smm
+bootblock-y += bootblock/pre_c.S
+bootblock-y += bootblock/bootblock.c
+bootblock-y += early.c
+bootblock-y += southbridge.c
+bootblock-y += i2c.c
+bootblock-$(CONFIG_PICASSO_UART) += uart.c
+bootblock-y += tsc_freq.c
+bootblock-y += gpio.c
+bootblock-y += smi_util.c
+
romstage-y += i2c.c
romstage-y += romstage.c
+romstage-y += early.c
romstage-y += gpio.c
romstage-y += pmutil.c
romstage-y += reset.c
@@ -56,12 +67,6 @@
verstage-$(CONFIG_PICASSO_UART) += uart.c
verstage-y += tsc_freq.c
-postcar-y += monotonic_timer.c
-postcar-$(CONFIG_PICASSO_UART) += uart.c
-postcar-y += memmap.c
-postcar-$(CONFIG_VBOOT_MEASURED_BOOT) += i2c.c
-postcar-y += tsc_freq.c
-
ramstage-y += i2c.c
ramstage-y += chip.c
ramstage-y += cpu.c
@@ -204,8 +209,15 @@
# type = 0x62
PSP_BIOSBIN_FILE=$(obj)/amd_biospsp.img
-PSP_BIOSBIN_DEST=$(CONFIG_ROMSTAGE_ADDR)
-PSP_BIOSBIN_SIZE=$(CONFIG_RAM_RESET_VECTOR_STAGE_SIZE)
+PSP_ELF_FILE=$(obj)/cbfs/fallback/bootblock.elf
+PSP_BIOSBIN_SIZE=$(CONFIG_C_ENV_BOOTBLOCK_SIZE)
+PSP_BIOSBIN_DEST=$(shell printf "%x" $(call int-subtract, $(call int-add, $(CONFIG_X86_RESET_VECTOR) 0x10) $(PSP_BIOSBIN_SIZE)))
+
+## INTERM=$(shell printf "%x" $(call int-add, $(CONFIG_X86_RESET_VECTOR) 0x10))
+## $(warning INTERM: $(INTERM))
+
+## $(warning PSP_BIOSBIN_DEST: $(CONFIG_X86_RESET_VECTOR) $(INTERM): $(PSP_BIOSBIN_DEST))
+## #$(shell printf "%d" $(CONFIG_STACK_SIZE))
# type = 0x63
PSP_APOBNV_BASE=$(CONFIG_PSP_APOB_NV_ADDRESS)
@@ -287,6 +299,12 @@
OPT_PSP_UCODE_FILE3=$(call add_opt_prefix, $(PSP_UCODE_FILE3), --instance 2 --ucode)
OPT_MP2CFG_FILE=$(call add_opt_prefix, $(PSP_MP2CFG_FILE), --mp2-config)
+$(PSP_BIOSBIN_FILE): $(PSP_ELF_FILE) $(AMDCOMPRESS)
+ rm -f $@
+ @printf " AMDCOMPRS $(subst $(obj)/,,$(@))\n"
+ $(AMDCOMPRESS) --infile $(PSP_ELF_FILE) --outfile $@ --compress \
+ --maxsize $(PSP_BIOSBIN_SIZE)
+
$(obj)/amdfw.rom: $(call strip_quotes, $(CONFIG_AMD_PUBKEY_FILE)) \
$(call strip_quotes, $(PUBSIGNEDKEY_FILE)) \
$(call strip_quotes, $(PSPBTLDR_FILE)) \
@@ -391,13 +409,6 @@
--location $(shell printf "0x%x" $(PICASSO_FWM_POSITION)) \
--output $@
-USE_BIOS_FILE=$(obj)/cbfs/fallback/romstage.elf
-$(PSP_BIOSBIN_FILE): $(obj)/cbfs/fallback/romstage.elf $(AMDCOMPRESS)
- rm -f $@
- @printf " AMDCOMPRS $(subst $(obj)/,,$(@))\n"
- $(AMDCOMPRESS) --infile $(USE_BIOS_FILE) --outfile $@ --compress \
- --maxsize $(PSP_BIOSBIN_SIZE)
-
ifeq ($(CONFIG_AMDFW_OUTSIDE_CBFS),y)
PHONY+=add_amdfw
INTERMEDIATE+=add_amdfw
diff --git a/src/soc/amd/picasso/bootblock/bootblock.c b/src/soc/amd/picasso/bootblock/bootblock.c
new file mode 100644
index 0000000..e448e1b
--- /dev/null
+++ b/src/soc/amd/picasso/bootblock/bootblock.c
@@ -0,0 +1,35 @@
+/*
+ * This file is part of the coreboot project.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+
+#include <stdint.h>
+#include <bootblock_common.h>
+#include <soc/early.h>
+#include <timestamp.h>
+
+asmlinkage void bootblock_c_entry(uint64_t base_timestamp)
+{
+ amd_initmmio();
+ set_caching();
+
+ bootblock_main_with_basetime(base_timestamp);
+}
+
+void bootblock_soc_early_init(void)
+{
+ soc_pre_console_init();
+}
+
+void bootblock_soc_init(void)
+{
+ soc_post_console_init();
+}
diff --git a/src/soc/amd/picasso/bootblock/pre_c.S b/src/soc/amd/picasso/bootblock/pre_c.S
new file mode 100644
index 0000000..ccff7e6
--- /dev/null
+++ b/src/soc/amd/picasso/bootblock/pre_c.S
@@ -0,0 +1,45 @@
+/*
+ * This file is part of the coreboot project.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+
+#include <cpu/x86/post_code.h>
+
+/*
+ * on entry:
+ * mm0: BIST (ignored)
+ * mm2_mm1: timestamp at bootblock_protected_mode_entry
+ */
+
+.global bootblock_pre_c_entry
+bootblock_pre_c_entry:
+ post_code(0xa0)
+
+ movl $_eearlyram_stack, %esp
+
+ /* Align the stack and keep aligned for call to bootblock_c_entry() */
+ and $0xfffffff0, %esp
+ sub $8, %esp
+
+ movd %mm2, %eax
+ pushl %eax /* tsc[63:32] */
+ movd %mm1, %eax
+ pushl %eax /* tsc[31:0] */
+
+ post_code(0xa2)
+
+ call bootblock_c_entry
+ /* Never reached */
+
+.halt_forever:
+ post_code(POST_DEAD_CODE)
+ hlt
+ jmp .halt_forever
diff --git a/src/soc/amd/picasso/early.c b/src/soc/amd/picasso/early.c
new file mode 100644
index 0000000..7b03a62
--- /dev/null
+++ b/src/soc/amd/picasso/early.c
@@ -0,0 +1,99 @@
+/*
+ * This file is part of the coreboot project.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+
+#include <stdint.h>
+#include <cpu/x86/cache.h>
+#include <cpu/x86/msr.h>
+#include <cpu/amd/msr.h>
+#include <cpu/x86/mtrr.h>
+#include <cpu/amd/mtrr.h>
+#include <console/console.h>
+#include <soc/early.h>
+#include <soc/southbridge.h>
+
+void amd_initmmio(void)
+{
+ msr_t mmconf;
+
+ mmconf.hi = 0;
+ mmconf.lo = CONFIG_MMCONF_BASE_ADDRESS | MMIO_RANGE_EN
+ | fms(CONFIG_MMCONF_BUS_NUMBER) << MMIO_BUS_RANGE_SHIFT;
+ wrmsr(MMIO_CONF_BASE, mmconf);
+}
+
+static const unsigned int fixed_mtrrs[] = {
+ MTRR_FIX_64K_00000,
+ MTRR_FIX_16K_80000,
+ MTRR_FIX_16K_A0000,
+ MTRR_FIX_4K_C0000,
+ MTRR_FIX_4K_C8000,
+ MTRR_FIX_4K_D0000,
+ MTRR_FIX_4K_D8000,
+ MTRR_FIX_4K_E0000,
+ MTRR_FIX_4K_E8000,
+ MTRR_FIX_4K_F0000,
+ MTRR_FIX_4K_F8000,
+};
+
+void set_caching(void)
+{
+ msr_t deftype, syscfg, rwmem;
+ int mtrr;
+ int i;
+
+ syscfg = rdmsr(SYSCFG_MSR);
+ syscfg.lo |= SYSCFG_MSR_MtrrFixDramModEn | SYSCFG_MSR_MtrrFixDramEn
+ | SYSCFG_MSR_MtrrVarDramEn;
+ wrmsr(SYSCFG_MSR, syscfg);
+
+ /* Write all as MTRR_READ_MEM | MTRR_WRITE_MEM to send cycles to DRAM */
+ rwmem.hi = rwmem.lo = 0x18181818;
+ for (i = 0 ; i < ARRAY_SIZE(fixed_mtrrs) ; i++)
+ wrmsr(fixed_mtrrs[i], rwmem);
+
+ syscfg.lo &= ~(SYSCFG_MSR_MtrrFixDramModEn | SYSCFG_MSR_MtrrFixDramEn);
+ wrmsr(SYSCFG_MSR, syscfg);
+
+ deftype = rdmsr(MTRR_DEF_TYPE_MSR);
+ deftype.lo &= ~MTRR_DEF_TYPE_MASK;
+ deftype.lo |= MTRR_DEF_TYPE_EN | MTRR_DEF_TYPE_FIX_EN | MTRR_TYPE_UNCACHEABLE;
+ wrmsr(MTRR_DEF_TYPE_MSR, deftype);
+
+ mtrr = get_free_var_mtrr();
+ if (mtrr < 0)
+ return;
+ set_var_mtrr(mtrr, FLASH_BASE_ADDR, CONFIG_ROM_SIZE, MTRR_TYPE_WRPROT);
+
+ mtrr = get_free_var_mtrr();
+ if (mtrr < 0)
+ return;
+ set_var_mtrr(mtrr, RESET_VECTOR_STAGE_BASE, RESET_VECTOR_STAGE_SIZE,
+ MTRR_TYPE_WRBACK);
+
+ enable_cache();
+}
+
+void soc_pre_console_init(void)
+{
+ sb_reset_i2c_slaves();
+ fch_pre_init();
+}
+
+void soc_post_console_init(void)
+{
+ u32 val = cpuid_eax(1);
+ printk(BIOS_DEBUG, "Family_Model: %08x\n", val);
+
+ fch_early_init();
+ i2c_soc_early_init();
+}
diff --git a/src/soc/amd/picasso/include/soc/early.h b/src/soc/amd/picasso/include/soc/early.h
new file mode 100644
index 0000000..8eb2645
--- /dev/null
+++ b/src/soc/amd/picasso/include/soc/early.h
@@ -0,0 +1,30 @@
+/*
+ * This file is part of the coreboot project.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+
+#ifndef __PICASSO_EARLY_H__
+#define __PICASSO_EARLY_H__
+
+#define RESET_VECTOR_STAGE_TOP (CONFIG_X86_RESET_VECTOR + 0x10)
+#define RESET_VECTOR_STAGE_SIZE CONFIG_C_ENV_BOOTBLOCK_SIZE
+#define RESET_VECTOR_STAGE_BASE (RESET_VECTOR_STAGE_TOP - RESET_VECTOR_STAGE_SIZE)
+
+#if (RESET_VECTOR_STAGE_BASE & (RESET_VECTOR_STAGE_SIZE - 1))
+#error "Adjust reset vector and program size for better MTRR coverage"
+#endif
+
+void amd_initmmio(void);
+void set_caching(void);
+void soc_pre_console_init(void);
+void soc_post_console_init(void);
+
+#endif /* __PICASSO_EARLY_H__ */
--
To view, visit https://review.coreboot.org/c/coreboot/+/37490
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I1d0784025f2b39f140b16f37726d4a7f36df6c6c
Gerrit-Change-Number: 37490
Gerrit-PatchSet: 1
Gerrit-Owner: Marshall Dawson <marshalldawson3rd(a)gmail.com>
Gerrit-Reviewer: Marshall Dawson <marshalldawson3rd(a)gmail.com>
Gerrit-Reviewer: Martin Roth <martinroth(a)google.com>
Gerrit-Reviewer: Patrick Georgi <pgeorgi(a)google.com>
Gerrit-MessageType: newchange
Kyösti Mälkki has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/35035 )
Change subject: [WIP] arch/x86: Add linker script for early DRAM
......................................................................
[WIP] arch/x86: Add linker script for early DRAM
Change-Id: I9c084ff6fdcf7e9154436f038705e8679daea780
Signed-off-by: Kyösti Mälkki <kyosti.malkki(a)gmail.com>
---
A src/arch/x86/early_dram.ld
1 file changed, 50 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/35/35035/1
diff --git a/src/arch/x86/early_dram.ld b/src/arch/x86/early_dram.ld
new file mode 100644
index 0000000..24b9551
--- /dev/null
+++ b/src/arch/x86/early_dram.ld
@@ -0,0 +1,50 @@
+/*
+ * This file is part of the coreboot project.
+ *
+ * Copyright (C) 2006 Advanced Micro Devices, Inc.
+ * Copyright (C) 2008-2010 coresystems GmbH
+ * Copyright 2015 Google Inc
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+
+/* This file is included inside a SECTIONS block */
+. = CONFIG_DCACHE_RAM_BASE;
+.car.data . (NOLOAD) : {
+ _car_region_start = . ;
+
+ /* Stack for CAR stages. Since it persists across all stages that
+ * use CAR it can be reused. The chipset/SoC is expected to provide
+ * the stack size. */
+#if CONFIG(C_ENVIRONMENT_BOOTBLOCK)
+ _car_stack_start = .;
+ . += CONFIG_DCACHE_BSP_STACK_SIZE;
+ _car_stack_end = .;
+#endif
+ /* The pre-ram cbmem console as well as the timestamp region are fixed
+ * in size. Therefore place them above the car global section so that
+ * multiple stages (romstage and verstage) have a consistent
+ * link address of these shared objects. */
+ PRERAM_CBMEM_CONSOLE(., CONFIG_PRERAM_CBMEM_CONSOLE_SIZE)
+
+ TIMESTAMP(., 0x200)
+
+ _car_ehci_dbg_info_start = .;
+ /* Reserve sizeof(struct ehci_dbg_info). */
+ . += 80;
+ _car_ehci_dbg_info_end = .;
+
+ _car_region_end = . + CONFIG_DCACHE_RAM_SIZE - (. - _car_region_start);
+}
+
+_bogus = ASSERT((CONFIG_DCACHE_RAM_SIZE == 0) || (SIZEOF(.car.data) <= CONFIG_DCACHE_RAM_SIZE), "Cache as RAM area is too full");
+#if !CONFIG(CAR_GLOBAL_MIGRATION)
+_bogus3 = ASSERT(CONFIG_DCACHE_BSP_STACK_SIZE > 0x0, "BSP stack size not configured");
+#endif
--
To view, visit https://review.coreboot.org/c/coreboot/+/35035
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I9c084ff6fdcf7e9154436f038705e8679daea780
Gerrit-Change-Number: 35035
Gerrit-PatchSet: 1
Gerrit-Owner: Kyösti Mälkki <kyosti.malkki(a)gmail.com>
Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org>
Gerrit-Reviewer: Kyösti Mälkki <kyosti.malkki(a)gmail.com>
Gerrit-MessageType: newchange
Patrick Rudolph has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/32705
Change subject: security/lockdown: Write-protect WP_RO
......................................................................
security/lockdown: Write-protect WP_RO
Add another choice to boot media protection and write-protect WP_RO
in case VBOOT is enabled.
Tested on Lenovo T520:
The WP_RO region is write-protected.
Change-Id: I72c3e1a0720514b9b85b0433944ab5fb7109b2a2
Signed-off-by: Patrick Rudolph <patrick.rudolph(a)9elements.com>
---
M src/security/lockdown/Kconfig
M src/security/lockdown/bootmedia.c
2 files changed, 29 insertions(+), 1 deletion(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/05/32705/1
diff --git a/src/security/lockdown/Kconfig b/src/security/lockdown/Kconfig
index bb4d072..1e982d8 100644
--- a/src/security/lockdown/Kconfig
+++ b/src/security/lockdown/Kconfig
@@ -15,6 +15,18 @@
config BOOTMEDIA_LOCK_NONE
bool "Don't lock boot media sections"
+config BOOTMEDIA_LOCK_VBOOT_RO
+ bool "Write-protect WP_RO region in boot media"
+ depends on VBOOT
+ help
+ Select this if you want to write-protect the WP_RO region as specified
+ in the VBOOT FMAP. You will only be able to write the regions
+ FW_MAIN_A/FW_MAIN_B, which are not write-protected using the internal
+ programmer.
+ The locking will take place during the chipset lockdown, which
+ is either triggered by coreboot (when INTEL_CHIPSET_LOCKDOWN is set)
+ or has to be triggered later (e.g. by the payload or the OS).
+
config BOOTMEDIA_LOCK_RO
bool "Write-protect the whole boot media"
help
diff --git a/src/security/lockdown/bootmedia.c b/src/security/lockdown/bootmedia.c
index 8fb4ae9..6fa2de2 100644
--- a/src/security/lockdown/bootmedia.c
+++ b/src/security/lockdown/bootmedia.c
@@ -17,6 +17,7 @@
#include <commonlib/region.h>
#include <console/console.h>
#include <bootstate.h>
+#include <fmap.h>
/*
* Enable write protection on the WP_RO region of the bootmedia.
@@ -47,8 +48,23 @@
"of whole bootmedia\n");
locked = true;
}
- }
+ } else if (CONFIG(BOOTMEDIA_LOCK_VBOOT_RO)) {
+ struct region_device dev;
+ if (fmap_locate_area_as_rdev("WP_RO", &dev) < 0) {
+ printk(BIOS_ERR, "BM-LOCKDOWN: Could not find region 'WP_RO'\n");
+ } else {
+ for (size_t i = 0; i < ARRAY_SIZE(wp_prot); i++) {
+ printk(BIOS_DEBUG, "BM-LOCKDOWN: Trying write-protection"
+ "#%zu ...\n", i);
+ if (boot_device_wp_region(&dev, wp_prot[i]) < 0)
+ continue;
+ printk(BIOS_INFO, "BM-LOCKDOWN: Enabled write-protection of"
+ "WP_RO region\n");
+ locked = true;
+ }
+ }
+ }
if (!locked)
printk(BIOS_INFO, "BM-LOCKDOWN: Didn't enable bootmedia protection\n");
}
--
To view, visit https://review.coreboot.org/c/coreboot/+/32705
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I72c3e1a0720514b9b85b0433944ab5fb7109b2a2
Gerrit-Change-Number: 32705
Gerrit-PatchSet: 1
Gerrit-Owner: Patrick Rudolph <patrick.rudolph(a)9elements.com>
Gerrit-MessageType: newchange
Patrick Rudolph has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/32704
Change subject: security: Add common boot media write protection
......................................................................
security: Add common boot media write protection
Introduce boot media protection settings and use the existing
boot_device_wp_region() function to apply settings on all
platforms that supports it yet.
Also remove the Intel southbridge code, which is now obsolete.
Tested on Lenovo T520. The whole flash is protected.
Change-Id: Iceb3ecf0bde5cec562bc62d1d5c79da35305d183
Signed-off-by: Patrick Rudolph <patrick.rudolph(a)9elements.com>
---
M src/security/Kconfig
M src/security/Makefile.inc
A src/security/lockdown/Kconfig
A src/security/lockdown/Makefile.inc
A src/security/lockdown/bootmedia.c
M src/soc/intel/common/block/fast_spi/Kconfig
M src/southbridge/intel/common/Kconfig
M src/southbridge/intel/common/finalize.c
8 files changed, 124 insertions(+), 49 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/04/32704/1
diff --git a/src/security/Kconfig b/src/security/Kconfig
index 6a334ac..99cb054 100644
--- a/src/security/Kconfig
+++ b/src/security/Kconfig
@@ -14,3 +14,4 @@
source "src/security/vboot/Kconfig"
source "src/security/tpm/Kconfig"
+source "src/security/lockdown/Kconfig"
diff --git a/src/security/Makefile.inc b/src/security/Makefile.inc
index a940b82..a74e498 100644
--- a/src/security/Makefile.inc
+++ b/src/security/Makefile.inc
@@ -1,2 +1,3 @@
subdirs-y += vboot
subdirs-y += tpm
+subdirs-y += lockdown
diff --git a/src/security/lockdown/Kconfig b/src/security/lockdown/Kconfig
new file mode 100644
index 0000000..bb4d072
--- /dev/null
+++ b/src/security/lockdown/Kconfig
@@ -0,0 +1,46 @@
+
+config SECURITY_BOOTMEDIA_LOCKDOWN
+ bool
+ default n
+ help
+ Platform support the locking of boot media. This can be for example
+ SPI controller protected regions or flash status register locking.
+
+if SECURITY_BOOTMEDIA_LOCKDOWN
+
+choice
+ prompt "Boot media protection"
+ default BOOTMEDIA_LOCK_NONE
+
+config BOOTMEDIA_LOCK_NONE
+ bool "Don't lock boot media sections"
+
+config BOOTMEDIA_LOCK_RO
+ bool "Write-protect the whole boot media"
+ help
+ Select this if you want to write-protect the whole firmware boot
+ media. The locking will take place during the chipset lockdown, which
+ is either triggered by coreboot (when INTEL_CHIPSET_LOCKDOWN is set)
+ or has to be triggered later (e.g. by the payload or the OS).
+
+ NOTE: If you trigger the chipset lockdown unconditionally,
+ you won't be able to write to the flash chip using the
+ internal programmer any more.
+
+config BOOTMEDIA_LOCK_NO_ACCESS
+ bool "Read- and write-protect the whole boot media"
+ help
+ Select this if you want to protect the firmware boot media against
+ all further accesses. On platforms that memory map a part of the
+ boot media the corresponding region is still readable.
+ The locking will take place during the chipset lockdown, which is
+ either triggered by coreboot (when INTEL_CHIPSET_LOCKDOWN is set) or
+ has to be triggered later (e.g. by the payload or the OS).
+
+ NOTE: If you trigger the chipset lockdown unconditionally,
+ you won't be able to write to the boot media using the
+ internal programmer any more.
+
+endchoice
+
+endif
diff --git a/src/security/lockdown/Makefile.inc b/src/security/lockdown/Makefile.inc
new file mode 100644
index 0000000..c287b9b
--- /dev/null
+++ b/src/security/lockdown/Makefile.inc
@@ -0,0 +1,16 @@
+##
+## This file is part of the coreboot project.
+##
+## Copyright (C) 2019 9elements Agency GmbH <patrick.rudolph(a)9elements.com>
+##
+## This program is free software; you can redistribute it and/or modify
+## it under the terms of the GNU General Public License as published by
+## the Free Software Foundation; version 2 of the License.
+##
+## This program is distributed in the hope that it will be useful,
+## but WITHOUT ANY WARRANTY; without even the implied warranty of
+## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+## GNU General Public License for more details.
+##
+
+ramstage-$(CONFIG_SECURITY_BOOTMEDIA_LOCKDOWN) += bootmedia.c
diff --git a/src/security/lockdown/bootmedia.c b/src/security/lockdown/bootmedia.c
new file mode 100644
index 0000000..8fb4ae9
--- /dev/null
+++ b/src/security/lockdown/bootmedia.c
@@ -0,0 +1,58 @@
+/*
+ * This file is part of the coreboot project.
+ *
+ * Copyright (C) 2019 9elements Agency GmbH <patrick.rudolph(a)9elements.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+
+#include <boot_device.h>
+#include <commonlib/region.h>
+#include <console/console.h>
+#include <bootstate.h>
+
+/*
+ * Enable write protection on the WP_RO region of the bootmedia.
+ */
+static void security_lockdown_bootmedia(void *unused)
+{
+ static const int wp_prot[] = {MEDIA_WP, CTRLR_WP};
+ const struct region_device *rdev;
+ bool locked = false;
+
+ if (CONFIG(BOOTMEDIA_LOCK_RO)) {
+ rdev = boot_device_ro();
+
+ for (size_t i = 0; i < ARRAY_SIZE(wp_prot); i++) {
+ printk(BIOS_DEBUG, "BM-LOCKDOWN: Trying write-protection"
+ "#%zu ...\n", i);
+ if (boot_device_wp_region(rdev, wp_prot[i]) < 0)
+ continue;
+
+ printk(BIOS_INFO, "BM-LOCKDOWN: Enabled write-protection of"
+ "whole bootmedia\n");
+ locked = true;
+ }
+ } else if (CONFIG(BOOTMEDIA_LOCK_NO_ACCESS)) {
+ rdev = boot_device_ro();
+ if (boot_device_wp_region(rdev, CTRLR_RWP) == 0) {
+ printk(BIOS_INFO, "BM-LOCKDOWN: Enabled read- and write protection"
+ "of whole bootmedia\n");
+ locked = true;
+ }
+ }
+
+ if (!locked)
+ printk(BIOS_INFO, "BM-LOCKDOWN: Didn't enable bootmedia protection\n");
+}
+
+/* BS_POST_DEVICE will lock the hardware */
+BOOT_STATE_INIT_ENTRY(BS_DEV_INIT, BS_ON_EXIT, security_lockdown_bootmedia,
+ NULL);
diff --git a/src/soc/intel/common/block/fast_spi/Kconfig b/src/soc/intel/common/block/fast_spi/Kconfig
index 4bd1f59..ff02844 100644
--- a/src/soc/intel/common/block/fast_spi/Kconfig
+++ b/src/soc/intel/common/block/fast_spi/Kconfig
@@ -1,5 +1,6 @@
config SOC_INTEL_COMMON_BLOCK_FAST_SPI
bool
+ select SECURITY_BOOTMEDIA_LOCKDOWN
help
Intel Processor common FAST_SPI support
diff --git a/src/southbridge/intel/common/Kconfig b/src/southbridge/intel/common/Kconfig
index c3bd90d..39234a8 100644
--- a/src/southbridge/intel/common/Kconfig
+++ b/src/southbridge/intel/common/Kconfig
@@ -20,6 +20,7 @@
config SOUTHBRIDGE_INTEL_COMMON_SPI
def_bool n
select SPI_FLASH
+ select SECURITY_BOOTMEDIA_LOCKDOWN
config SOUTHBRIDGE_INTEL_COMMON_PIRQ_ACPI_GEN
def_bool n
@@ -68,42 +69,3 @@
config SOUTHBRIDGE_INTEL_COMMON_WATCHDOG
bool
depends on SOUTHBRIDGE_INTEL_COMMON
-
-if SOUTHBRIDGE_INTEL_COMMON_FINALIZE
-
-choice
- prompt "Flash locking during chipset lockdown"
- default LOCK_SPI_FLASH_NONE
-
-config LOCK_SPI_FLASH_NONE
- bool "Don't lock flash sections"
-
-config LOCK_SPI_FLASH_RO
- bool "Write-protect all flash sections"
- help
- Select this if you want to write-protect the whole firmware flash
- chip. The locking will take place during the chipset lockdown, which
- is either triggered by coreboot (when INTEL_CHIPSET_LOCKDOWN is set)
- or has to be triggered later (e.g. by the payload or the OS).
-
- NOTE: If you trigger the chipset lockdown unconditionally,
- you won't be able to write to the flash chip using the
- internal programmer any more.
-
-config LOCK_SPI_FLASH_NO_ACCESS
- bool "Write-protect all flash sections and read-protect non-BIOS sections"
- help
- Select this if you want to protect the firmware flash against all
- further accesses (with the exception of the memory mapped BIOS re-
- gion which is always readable). The locking will take place during
- the chipset lockdown, which is either triggered by coreboot (when
- INTEL_CHIPSET_LOCKDOWN is set) or has to be triggered later (e.g.
- by the payload or the OS).
-
- NOTE: If you trigger the chipset lockdown unconditionally,
- you won't be able to write to the flash chip using the
- internal programmer any more.
-
-endchoice
-
-endif
diff --git a/src/southbridge/intel/common/finalize.c b/src/southbridge/intel/common/finalize.c
index 80c65bb..6f7934a 100644
--- a/src/southbridge/intel/common/finalize.c
+++ b/src/southbridge/intel/common/finalize.c
@@ -28,16 +28,6 @@
{
const pci_devfn_t lpc_dev = PCI_DEV(0, 0x1f, 0);
- if (CONFIG(LOCK_SPI_FLASH_RO) ||
- CONFIG(LOCK_SPI_FLASH_NO_ACCESS)) {
- int i;
- u32 lockmask = 1UL << 31;
- if (CONFIG(LOCK_SPI_FLASH_NO_ACCESS))
- lockmask |= 1 << 15;
- for (i = 0; i < 20; i += 4)
- RCBA32(0x3874 + i) = RCBA32(0x3854 + i) | lockmask;
- }
-
/* Lock SPIBAR */
RCBA32_OR(0x3804, (1 << 15));
--
To view, visit https://review.coreboot.org/c/coreboot/+/32704
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Iceb3ecf0bde5cec562bc62d1d5c79da35305d183
Gerrit-Change-Number: 32704
Gerrit-PatchSet: 1
Gerrit-Owner: Patrick Rudolph <patrick.rudolph(a)9elements.com>
Gerrit-Reviewer: Martin Roth <martinroth(a)google.com>
Gerrit-Reviewer: Patrick Georgi <pgeorgi(a)google.com>
Gerrit-Reviewer: Patrick Rudolph <patrick.rudolph(a)9elements.com>
Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org>
Gerrit-MessageType: newchange