coreboot-gerrit November 2021

coreboot-gerrit@coreboot.org

1 participants
6394 discussions

Change in coreboot[master]: security/intel/txt: Allow platforms without FIT to use Intel TXT
by Michał Żygowski (Code Review) 27 Nov '21

27 Nov '21

Michał Żygowski has submitted this change. ( https://review.coreboot.org/c/coreboot/+/59518 ) Change subject: security/intel/txt: Allow platforms without FIT to use Intel TXT ...................................................................... security/intel/txt: Allow platforms without FIT to use Intel TXT There is no real code or feature dependency on CPU_INTEL_FIRMWARE_INTERFACE_TABLE for Intel TXT. Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: I2858c8de9396449a0ee30837a98fab05570a6259 Reviewed-on: https://review.coreboot.org/c/coreboot/+/59518 Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org> Reviewed-by: Angel Pons <th3fanbus(a)gmail.com> --- M src/security/intel/txt/Kconfig 1 file changed, 0 insertions(+), 1 deletion(-) Approvals: build bot (Jenkins): Verified Angel Pons: Looks good to me, approved diff --git a/src/security/intel/txt/Kconfig b/src/security/intel/txt/Kconfig index 6d23583..19eecc4 100644 --- a/src/security/intel/txt/Kconfig +++ b/src/security/intel/txt/Kconfig @@ -8,7 +8,6 @@ select AP_IN_SIPI_WAIT select TPM_MEASURED_BOOT_INIT_BOOTBLOCK if TPM_MEASURED_BOOT depends on TPM - depends on CPU_INTEL_FIRMWARE_INTERFACE_TABLE depends on PLATFORM_HAS_DRAM_CLEAR depends on (SOC_INTEL_COMMON_BLOCK_SA || HAVE_CF9_RESET) 10 is the latest approved patch-set. No files were changed between the latest approved patch-set and the submitted one. -- To view, visit https://review.coreboot.org/c/coreboot/+/59518 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I2858c8de9396449a0ee30837a98fab05570a6259 Gerrit-Change-Number: 59518 Gerrit-PatchSet: 12 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-MessageType: merged

1 0

Change in coreboot[master]: security/intel/txt: Issue a global reset when TXT_RESET bit is set
by Michał Żygowski (Code Review) 27 Nov '21

27 Nov '21

Michał Żygowski has submitted this change. ( https://review.coreboot.org/c/coreboot/+/59639 ) Change subject: security/intel/txt: Issue a global reset when TXT_RESET bit is set ...................................................................... security/intel/txt: Issue a global reset when TXT_RESET bit is set Although TXT specification says to do power cycle reset if TXT_RESET is set, all Intel provided implementations issue a global reset here. TEST=Perform ungraceful shutdown after SENTER to trigger SCLEAN path on Dell OptiPlex 9010 and successfully call ACM SCLEAN. Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: I8ee2400fab20857ff89b14bb7b662a938b775304 Reviewed-on: https://review.coreboot.org/c/coreboot/+/59639 Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org> Reviewed-by: Angel Pons <th3fanbus(a)gmail.com> --- M src/security/intel/txt/common.c M src/security/intel/txt/romstage.c M src/security/intel/txt/txt.h 3 files changed, 4 insertions(+), 4 deletions(-) Approvals: build bot (Jenkins): Verified Angel Pons: Looks good to me, approved diff --git a/src/security/intel/txt/common.c b/src/security/intel/txt/common.c index 61ff0eb..14bd296 100644 --- a/src/security/intel/txt/common.c +++ b/src/security/intel/txt/common.c @@ -27,7 +27,7 @@ #include "txt_getsec.h" /* Usual security practice: if an unexpected error happens, reboot */ -static void __noreturn txt_reset_platform(void) +void __noreturn txt_reset_platform(void) { #if CONFIG(SOC_INTEL_COMMON_BLOCK_SA) global_reset(); diff --git a/src/security/intel/txt/romstage.c b/src/security/intel/txt/romstage.c index ef069ef..63db10f 100644 --- a/src/security/intel/txt/romstage.c +++ b/src/security/intel/txt/romstage.c @@ -108,8 +108,8 @@ printk(BIOS_ERR, "TEE-TXT: Secrets remain in memory. SCLEAN is required.\n"); if (txt_ests & TXT_ESTS_TXT_RESET_STS) { - printk(BIOS_ERR, "TEE-TXT: TXT_RESET bit set, doing full reset!\n"); - full_reset(); + printk(BIOS_ERR, "TEE-TXT: TXT_RESET bit set, doing global reset!\n"); + txt_reset_platform(); } /* FIXME: Clear SLP_TYP# */ diff --git a/src/security/intel/txt/txt.h b/src/security/intel/txt/txt.h index 63ac91c..64e507d 100644 --- a/src/security/intel/txt/txt.h +++ b/src/security/intel/txt/txt.h @@ -18,7 +18,7 @@ #define ACM_E_PLATFORM_IS_NOT_PROD 0x10 void intel_txt_romstage_init(void); - +void __noreturn txt_reset_platform(void); void intel_txt_log_bios_acm_error(void); int intel_txt_log_acm_error(const uint32_t acm_error); void intel_txt_log_spad(void); 3 is the latest approved patch-set. No files were changed between the latest approved patch-set and the submitted one. -- To view, visit https://review.coreboot.org/c/coreboot/+/59639 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I8ee2400fab20857ff89b14bb7b662a938b775304 Gerrit-Change-Number: 59639 Gerrit-PatchSet: 6 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-MessageType: merged

1 0

Change in coreboot[master]: [WIP] ChromeOS: Move CRHW device object
by Kyösti Mälkki (Code Review) 27 Nov '21

27 Nov '21

Hello build bot (Jenkins), Tim Wawrzynczak, I'd like you to reexamine a change. Please visit https://review.coreboot.org/c/coreboot/+/58421 to look at the new patch set (#9). Change subject: [WIP] ChromeOS: Move CRHW device object ...................................................................... [WIP] ChromeOS: Move CRHW device object In ACPI spec all Device Objects should be located under \_SB. So \CRHW was not allowed. The allocation is no longer GNVS but was renamed to CNVS and it is not globally available for ASL. Change-Id: I449d0206fbaee94cea99f745cf297ad293e8306c Signed-off-by: Kyösti Mälkki <kyosti.malkki(a)gmail.com> --- M src/vendorcode/google/chromeos/acpi/chromeos.asl D src/vendorcode/google/chromeos/acpi/gnvs.asl M src/vendorcode/google/chromeos/acpi/ramoops.asl M src/vendorcode/google/chromeos/gnvs.c 4 files changed, 108 insertions(+), 112 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/21/58421/9 -- To view, visit https://review.coreboot.org/c/coreboot/+/58421 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I449d0206fbaee94cea99f745cf297ad293e8306c Gerrit-Change-Number: 58421 Gerrit-PatchSet: 9 Gerrit-Owner: Kyösti Mälkki <kyosti.malkki(a)gmail.com> Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-MessageType: newpatchset

1 0

Change in coreboot[master]: ChromeOS: Refactor ACPI CNVS generation
by Kyösti Mälkki (Code Review) 27 Nov '21

27 Nov '21

Attention is currently required from: Lance Zhao, Jason Glenesk, Furquan Shaikh, Marshall Dawson, Tim Wawrzynczak, Nick Vaccaro, Julius Werner, Felix Held. Hello Lance Zhao, build bot (Jenkins), Jason Glenesk, Furquan Shaikh, Marshall Dawson, Tim Wawrzynczak, Nick Vaccaro, Angel Pons, Julius Werner, Felix Held, I'd like you to reexamine a change. Please visit https://review.coreboot.org/c/coreboot/+/55502 to look at the new patch set (#16). Change subject: ChromeOS: Refactor ACPI CNVS generation ...................................................................... ChromeOS: Refactor ACPI CNVS generation Remove chromeos_dsdt_generator() calls under mainboard, it is possible to make the single call to fill \CNVS and \OIPG without leveraging device operations. Change-Id: Id79af96bb6c038d273ac9c4afc723437fc1f3fc9 Signed-off-by: Kyösti Mälkki <kyosti.malkki(a)gmail.com> --- M src/acpi/acpigen_extern.asl M src/acpi/dsdt_top.asl M src/lib/hardwaremain.c M src/mainboard/amd/majolica/mainboard.c M src/mainboard/google/auron/mainboard.c M src/mainboard/google/beltino/mainboard.c M src/mainboard/google/brya/mainboard.c M src/mainboard/google/butterfly/mainboard.c M src/mainboard/google/cyan/mainboard.c M src/mainboard/google/dedede/mainboard.c M src/mainboard/google/deltaur/mainboard.c M src/mainboard/google/drallion/ramstage.c M src/mainboard/google/eve/mainboard.c M src/mainboard/google/fizz/mainboard.c M src/mainboard/google/glados/mainboard.c M src/mainboard/google/guybrush/mainboard.c M src/mainboard/google/hatch/ramstage.c M src/mainboard/google/jecht/mainboard.c M src/mainboard/google/kahlee/mainboard.c M src/mainboard/google/link/mainboard.c M src/mainboard/google/octopus/mainboard.c M src/mainboard/google/parrot/mainboard.c M src/mainboard/google/poppy/mainboard.c M src/mainboard/google/rambi/mainboard.c M src/mainboard/google/reef/mainboard.c M src/mainboard/google/sarien/ramstage.c M src/mainboard/google/slippy/mainboard.c M src/mainboard/google/stout/mainboard.c M src/mainboard/google/volteer/mainboard.c M src/mainboard/google/zork/mainboard.c M src/mainboard/intel/adlrvp/mainboard.c M src/mainboard/intel/baskingridge/mainboard.c M src/mainboard/intel/coffeelake_rvp/mainboard.c M src/mainboard/intel/emeraldlake2/mainboard.c M src/mainboard/intel/glkrvp/mainboard.c M src/mainboard/intel/icelake_rvp/mainboard.c M src/mainboard/intel/jasperlake_rvp/mainboard.c M src/mainboard/intel/kblrvp/mainboard.c M src/mainboard/intel/kunimitsu/mainboard.c M src/mainboard/intel/shadowmountain/mainboard.c M src/mainboard/intel/strago/mainboard.c M src/mainboard/intel/tglrvp/mainboard.c M src/mainboard/intel/wtm2/mainboard.c M src/mainboard/samsung/lumpy/mainboard.c M src/mainboard/samsung/stumpy/mainboard.c M src/vendorcode/google/chromeos/acpi.c M src/vendorcode/google/chromeos/acpi/chromeos.asl M src/vendorcode/google/chromeos/acpi/gnvs.asl M src/vendorcode/google/chromeos/chromeos.h M src/vendorcode/google/chromeos/gnvs.c M src/vendorcode/google/chromeos/gnvs.h 51 files changed, 15 insertions(+), 143 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/02/55502/16 -- To view, visit https://review.coreboot.org/c/coreboot/+/55502 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Id79af96bb6c038d273ac9c4afc723437fc1f3fc9 Gerrit-Change-Number: 55502 Gerrit-PatchSet: 16 Gerrit-Owner: Kyösti Mälkki <kyosti.malkki(a)gmail.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Felix Held <felix-coreboot(a)felixheld.de> Gerrit-Reviewer: Furquan Shaikh <furquan.m.shaikh(a)gmail.com> Gerrit-Reviewer: Jason Glenesk <jason.glenesk(a)gmail.com> Gerrit-Reviewer: Julius Werner <jwerner(a)chromium.org> Gerrit-Reviewer: Lance Zhao Gerrit-Reviewer: Marshall Dawson <marshalldawson3rd(a)gmail.com> Gerrit-Reviewer: Nick Vaccaro <nvaccaro(a)chromium.org> Gerrit-Reviewer: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Lance Zhao Gerrit-Attention: Jason Glenesk <jason.glenesk(a)gmail.com> Gerrit-Attention: Furquan Shaikh <furquan.m.shaikh(a)gmail.com> Gerrit-Attention: Marshall Dawson <marshalldawson3rd(a)gmail.com> Gerrit-Attention: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Attention: Nick Vaccaro <nvaccaro(a)chromium.org> Gerrit-Attention: Julius Werner <jwerner(a)chromium.org> Gerrit-Attention: Felix Held <felix-coreboot(a)felixheld.de> Gerrit-MessageType: newpatchset

1 0

Change in coreboot[master]: security/intel/txt: Use set_global_reset in txt_reset_platform if pos...
by Michał Żygowski (Code Review) 27 Nov '21

27 Nov '21

Michał Żygowski has submitted this change. ( https://review.coreboot.org/c/coreboot/+/59517 ) Change subject: security/intel/txt: Use set_global_reset in txt_reset_platform if possible ...................................................................... security/intel/txt: Use set_global_reset in txt_reset_platform if possible Allow to set global reset bits on other platforms which enable SOUTHBRIDGE_INTEL_COMMON_ME. In certain Intel TXT flows global reset instead of full power cycle reset is needed. Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: I561458044860ee5a26f7d61bcff1c407fa1533f2 Reviewed-on: https://review.coreboot.org/c/coreboot/+/59517 Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org> Reviewed-by: Angel Pons <th3fanbus(a)gmail.com> --- M src/security/intel/txt/common.c 1 file changed, 6 insertions(+), 0 deletions(-) Approvals: build bot (Jenkins): Verified Angel Pons: Looks good to me, approved diff --git a/src/security/intel/txt/common.c b/src/security/intel/txt/common.c index 18dbe06..61ff0eb 100644 --- a/src/security/intel/txt/common.c +++ b/src/security/intel/txt/common.c @@ -16,6 +16,9 @@ #if CONFIG(SOC_INTEL_COMMON_BLOCK_SA) #include <soc/intel/common/reset.h> #else +#if CONFIG(SOUTHBRIDGE_INTEL_COMMON_ME) +#include <southbridge/intel/common/me.h> +#endif #include <cf9_reset.h> #endif @@ -29,6 +32,9 @@ #if CONFIG(SOC_INTEL_COMMON_BLOCK_SA) global_reset(); #else +#if CONFIG(SOUTHBRIDGE_INTEL_COMMON_ME) + set_global_reset(1); +#endif full_reset(); #endif } 6 is the latest approved patch-set. No files were changed between the latest approved patch-set and the submitted one. -- To view, visit https://review.coreboot.org/c/coreboot/+/59517 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I561458044860ee5a26f7d61bcff1c407fa1533f2 Gerrit-Change-Number: 59517 Gerrit-PatchSet: 9 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-MessageType: merged

1 0

Change in coreboot[master]: security/intel/txt: Implement GETSEC PARAMETER dumping
by Michał Żygowski (Code Review) 27 Nov '21

27 Nov '21

Michał Żygowski has submitted this change. ( https://review.coreboot.org/c/coreboot/+/59516 ) Change subject: security/intel/txt: Implement GETSEC PARAMETER dumping ...................................................................... security/intel/txt: Implement GETSEC PARAMETER dumping Currently there is only a function that dumps GETSEC CAPABILITIES. Add dumping GETSEC PARAMETER for completeness and additional debug information. Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: I3b2c8337a8d86000a5b43788840d15146b662598 Reviewed-on: https://review.coreboot.org/c/coreboot/+/59516 Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org> Reviewed-by: Arthur Heymans <arthur(a)aheymans.xyz> --- M src/security/intel/txt/common.c M src/security/intel/txt/logging.c M src/security/intel/txt/txt_register.h 3 files changed, 46 insertions(+), 0 deletions(-) Approvals: build bot (Jenkins): Verified Arthur Heymans: Looks good to me, approved diff --git a/src/security/intel/txt/common.c b/src/security/intel/txt/common.c index accdf3c..18dbe06 100644 --- a/src/security/intel/txt/common.c +++ b/src/security/intel/txt/common.c @@ -441,6 +441,10 @@ printk(BIOS_DEBUG, " SENTER available: %s\n", (eax & BIT(4)) ? "true" : "false"); printk(BIOS_DEBUG, " SEXIT available: %s\n", (eax & BIT(5)) ? "true" : "false"); printk(BIOS_DEBUG, " PARAMETERS available: %s\n", (eax & BIT(6)) ? "true" : "false"); + printk(BIOS_DEBUG, " SMCTRL available: %s\n", (eax & BIT(7)) ? "true" : "false"); + printk(BIOS_DEBUG, " WAKEUP available: %s\n", (eax & BIT(8)) ? "true" : "false"); + + txt_dump_getsec_parameters(); /* * Causes #GP if function is not supported by getsec. diff --git a/src/security/intel/txt/logging.c b/src/security/intel/txt/logging.c index f73ae4b..f3e37aa 100644 --- a/src/security/intel/txt/logging.c +++ b/src/security/intel/txt/logging.c @@ -7,6 +7,7 @@ #include <types.h> #include "txt.h" +#include "txt_getsec.h" #include "txt_register.h" const char *intel_txt_processor_error_type(uint8_t type) @@ -221,3 +222,43 @@ bdr->lcp_pd_base); } } + +void txt_dump_getsec_parameters(void) +{ + uint32_t version_mask; + uint32_t version_numbers_supported; + uint32_t max_size_acm_area; + uint32_t memory_type_mask; + uint32_t senter_function_disable; + uint32_t txt_feature_flags; + + if (!getsec_parameter(&version_mask, &version_numbers_supported, + &max_size_acm_area, &memory_type_mask, + &senter_function_disable, &txt_feature_flags)) { + printk(BIOS_WARNING, "Could not obtain GETSEC parameters\n"); + return; + } + printk(BIOS_DEBUG, "TEE-TXT: GETSEC[PARAMETERS] returned:\n"); + printk(BIOS_DEBUG, " ACM Version comparison mask: %08x\n", version_mask); + printk(BIOS_DEBUG, " ACM Version numbers supported: %08x\n", + version_numbers_supported); + printk(BIOS_DEBUG, " Max size of authenticated code execution area: %08x\n", + max_size_acm_area); + printk(BIOS_DEBUG, " External memory types supported during AC mode: %08x\n", + memory_type_mask); + printk(BIOS_DEBUG, " Selective SENTER functionality control: %02x\n", + (senter_function_disable >> 8) & 0x7f); + printk(BIOS_DEBUG, " Feature Extensions Flags: %08x\n", txt_feature_flags); + printk(BIOS_DEBUG, "\tS-CRTM Capability rooted in: "); + if (txt_feature_flags & GETSEC_PARAMS_TXT_EXT_CRTM_SUPPORT) { + printk(BIOS_DEBUG, "processor\n"); + } else { + printk(BIOS_DEBUG, "BIOS\n"); + } + printk(BIOS_DEBUG, "\tMachine Check Register: "); + if (txt_feature_flags & GETSEC_PARAMS_TXT_EXT_MACHINE_CHECK) { + printk(BIOS_DEBUG, "preserved\n"); + } else { + printk(BIOS_DEBUG, "must be clear\n"); + } +} diff --git a/src/security/intel/txt/txt_register.h b/src/security/intel/txt/txt_register.h index bb735b6..7971884 100644 --- a/src/security/intel/txt/txt_register.h +++ b/src/security/intel/txt/txt_register.h @@ -283,5 +283,6 @@ void txt_dump_regions(void); void txt_dump_chipset_info(void); void txt_dump_acm_info(const struct acm_header_v0 *acm_header); +void txt_dump_getsec_parameters(void); #endif /* SECURITY_INTEL_TXT_REGISTER_H_ */ 4 is the latest approved patch-set. No files were changed between the latest approved patch-set and the submitted one. -- To view, visit https://review.coreboot.org/c/coreboot/+/59516 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I3b2c8337a8d86000a5b43788840d15146b662598 Gerrit-Change-Number: 59516 Gerrit-PatchSet: 7 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Reviewer: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Patrick Rudolph <siro(a)das-labor.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-MessageType: merged

1 0

Change in coreboot[master]: security/intel/txt: Remove unused region device
by Michał Żygowski (Code Review) 27 Nov '21

27 Nov '21

Michał Żygowski has submitted this change. ( https://review.coreboot.org/c/coreboot/+/59515 ) Change subject: security/intel/txt: Remove unused region device ...................................................................... security/intel/txt: Remove unused region device Region device is no longer used to locate BIOS ACM. Use new CBFS API to map and unmap the file. Using rdev_munmap on the uninitialized region device variable causes the platform to jump to a random address. TEST=Dell OptiPlex 9010 does not raise #UD exception when Intel TXT is enabled, ACM SCHECK is successful Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: I98afba35403d5d2cd9eeb7df6d1ca0171894e9d4 Reviewed-on: https://review.coreboot.org/c/coreboot/+/59515 Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org> Reviewed-by: Arthur Heymans <arthur(a)aheymans.xyz> Reviewed-by: Angel Pons <th3fanbus(a)gmail.com> Reviewed-by: Patrick Rudolph <siro(a)das-labor.org> --- M src/security/intel/txt/common.c 1 file changed, 6 insertions(+), 8 deletions(-) Approvals: build bot (Jenkins): Verified Patrick Rudolph: Looks good to me, approved Arthur Heymans: Looks good to me, approved Angel Pons: Looks good to me, but someone else must approve diff --git a/src/security/intel/txt/common.c b/src/security/intel/txt/common.c index 7e6c55c..accdf3c 100644 --- a/src/security/intel/txt/common.c +++ b/src/security/intel/txt/common.c @@ -230,11 +230,11 @@ * Prepare to run the BIOS ACM: mmap it from the CBFS and verify that it * can be launched. Returns pointer to ACM on success, NULL on failure. */ -static void *intel_txt_prepare_bios_acm(struct region_device *acm, size_t *acm_len) +static void *intel_txt_prepare_bios_acm(size_t *acm_len) { void *acm_data = NULL; - if (!acm || !acm_len) + if (!acm_len) return NULL; acm_data = cbfs_map(CONFIG_INTEL_TXT_CBFS_BIOS_ACM, acm_len); @@ -307,10 +307,9 @@ /* Returns on failure, resets the computer on success */ void intel_txt_run_sclean(void) { - struct region_device acm; size_t acm_len; - void *acm_data = intel_txt_prepare_bios_acm(&acm, &acm_len); + void *acm_data = intel_txt_prepare_bios_acm(&acm_len); if (!acm_data) return; @@ -338,7 +337,7 @@ */ printk(BIOS_CRIT, "TEE-TXT: getsec_sclean could not launch the BIOS ACM.\n"); - rdev_munmap(&acm, acm_data); + cbfs_unmap(acm_data); } /* @@ -348,10 +347,9 @@ */ int intel_txt_run_bios_acm(const u8 input_params) { - struct region_device acm; size_t acm_len; - void *acm_data = intel_txt_prepare_bios_acm(&acm, &acm_len); + void *acm_data = intel_txt_prepare_bios_acm(&acm_len); if (!acm_data) return -1; @@ -359,7 +357,7 @@ /* Call into assembly which invokes the referenced ACM */ getsec_enteraccs(input_params, (uintptr_t)acm_data, acm_len); - rdev_munmap(&acm, acm_data); + cbfs_unmap(acm_data); const uint64_t acm_status = read64((void *)TXT_SPAD); if (acm_status & ACMERROR_TXT_VALID) { 5 is the latest approved patch-set. No files were changed between the latest approved patch-set and the submitted one. -- To view, visit https://review.coreboot.org/c/coreboot/+/59515 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I98afba35403d5d2cd9eeb7df6d1ca0171894e9d4 Gerrit-Change-Number: 59515 Gerrit-PatchSet: 9 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Reviewer: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-MessageType: merged

1 0

Change in coreboot[master]: security/intel/txt: Correct reporting of chipset production fuse state
by Michał Żygowski (Code Review) 27 Nov '21

27 Nov '21

Michał Żygowski has submitted this change. ( https://review.coreboot.org/c/coreboot/+/59514 ) Change subject: security/intel/txt: Correct reporting of chipset production fuse state ...................................................................... security/intel/txt: Correct reporting of chipset production fuse state Implement the chipset production fuse state reporting as described in the Intel TXT Software Development Guide. Also fix all occurrences where the production fuse state is checked. TEST=Dell OptiPlex 9010 with i7-3770/Q77 reports the chipset is production fused Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: Ic86c5a9e1d162630a1cf61435d1014edabf104b0 Reviewed-on: https://review.coreboot.org/c/coreboot/+/59514 Reviewed-by: Patrick Rudolph <siro(a)das-labor.org> Tested-by: build bot (Jenkins) <no-reply(a)coreboot.org> --- M src/security/intel/txt/common.c M src/security/intel/txt/logging.c M src/security/intel/txt/txt.h 3 files changed, 20 insertions(+), 3 deletions(-) Approvals: build bot (Jenkins): Verified Patrick Rudolph: Looks good to me, approved diff --git a/src/security/intel/txt/common.c b/src/security/intel/txt/common.c index e3e2f5c..7e6c55c 100644 --- a/src/security/intel/txt/common.c +++ b/src/security/intel/txt/common.c @@ -141,6 +141,22 @@ return ret; } +bool intel_txt_chipset_is_production_fused(void) +{ + /* + * Certain chipsets report production fused information in either + * TXT.VER.FSBIF or TXT.VER.EMIF/TXT.VER.QPIIF. + * Chapter B.1.7 and B.1.9 + * Intel TXT Software Development Guide (Document: 315168-015) + */ + uint32_t reg = read32((void *)TXT_VER_FSBIF); + + if (reg == 0 || reg == UINT32_MAX) + reg = read32((void *)TXT_VER_QPIIF); + + return (reg & TXT_VER_PRODUCTION_FUSED) ? true : false; +} + static struct acm_info_table *find_info_table(const void *ptr) { const struct acm_header_v0 *acm_header = (struct acm_header_v0 *)ptr; @@ -203,8 +219,8 @@ if (memcmp(acm_uuid, info->uuid, sizeof(acm_uuid)) != 0) return ACM_E_UUID_NOT_MATCH; - if ((acm_header->flags & ACM_FORMAT_FLAGS_DEBUG) == - (read64((void *)TXT_VER_FSBIF) & TXT_VER_PRODUCTION_FUSED)) + const bool production_acm = !(acm_header->flags & ACM_FORMAT_FLAGS_DEBUG); + if (production_acm != intel_txt_chipset_is_production_fused()) return ACM_E_PLATFORM_IS_NOT_PROD; return 0; diff --git a/src/security/intel/txt/logging.c b/src/security/intel/txt/logging.c index b4eac33..f73ae4b 100644 --- a/src/security/intel/txt/logging.c +++ b/src/security/intel/txt/logging.c @@ -185,7 +185,7 @@ printk(BIOS_INFO, "TEE-TXT: DIDVID 0x%x\n", read32((void *)TXT_DIDVID)); printk(BIOS_INFO, "TEE-TXT: production fused chipset: %s\n", - (read64((void *)TXT_VER_FSBIF) & TXT_VER_PRODUCTION_FUSED) ? "true" : "false"); + intel_txt_chipset_is_production_fused() ? "true" : "false"); } void txt_dump_regions(void) diff --git a/src/security/intel/txt/txt.h b/src/security/intel/txt/txt.h index e1a78af..63ac91c 100644 --- a/src/security/intel/txt/txt.h +++ b/src/security/intel/txt/txt.h @@ -23,6 +23,7 @@ int intel_txt_log_acm_error(const uint32_t acm_error); void intel_txt_log_spad(void); bool intel_txt_memory_has_secrets(void); +bool intel_txt_chipset_is_production_fused(void); void intel_txt_run_sclean(void); int intel_txt_run_bios_acm(const u8 input_params); bool intel_txt_prepare_txt_env(void); -- To view, visit https://review.coreboot.org/c/coreboot/+/59514 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Ic86c5a9e1d162630a1cf61435d1014edabf104b0 Gerrit-Change-Number: 59514 Gerrit-PatchSet: 7 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Reviewer: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-MessageType: merged

1 0

Change in coreboot[master]: src/arch/ppc64/*: pass FDT address to payload
by Sergii Dmytruk (Code Review) 27 Nov '21

27 Nov '21

Attention is currently required from: Krystian Hebel, Timothy Pearson, Ron Minnich. Sergii Dmytruk has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/57084 ) Change subject: src/arch/ppc64/*: pass FDT address to payload ...................................................................... Patch Set 21: (1 comment) Commit Message: https://review.coreboot.org/c/coreboot/+/57084/comment/b6796002_1ba61b8b PS21, Line 10: %r17. We use one of two hypervisor's special registers as a buffer, > %r27? Typo, thanks. -- To view, visit https://review.coreboot.org/c/coreboot/+/57084 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I0911f4b534c6f8cacfa057a5bad7576fec711637 Gerrit-Change-Number: 57084 Gerrit-PatchSet: 21 Gerrit-Owner: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com> Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Reviewer: Krystian Hebel <krystian.hebel(a)3mdeb.com> Gerrit-Reviewer: Ron Minnich <rminnich(a)gmail.com> Gerrit-Reviewer: Timothy Pearson <tpearson(a)raptorengineering.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Maciej Pijanowski <maciej.pijanowski(a)3mdeb.com> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Krystian Hebel <krystian.hebel(a)3mdeb.com> Gerrit-Attention: Timothy Pearson <tpearson(a)raptorengineering.com> Gerrit-Attention: Ron Minnich <rminnich(a)gmail.com> Gerrit-Comment-Date: Sat, 27 Nov 2021 13:08:19 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Krystian Hebel <krystian.hebel(a)3mdeb.com> Gerrit-MessageType: comment

1 0

Change in coreboot[master]: payloads/external: add skiboot (for QEMU/Power9)
by Sergii Dmytruk (Code Review) 27 Nov '21

27 Nov '21

Attention is currently required from: Martin Roth, Igor Bagnucki, Stefan Reinauer, Krystian Hebel, Timothy Pearson. Hello build bot (Jenkins), Martin Roth, Igor Bagnucki, Stefan Reinauer, Krystian Hebel, Timothy Pearson, I'd like you to reexamine a change. Please visit https://review.coreboot.org/c/coreboot/+/58656 to look at the new patch set (#12). Change subject: payloads/external: add skiboot (for QEMU/Power9) ...................................................................... payloads/external: add skiboot (for QEMU/Power9) Add an option to build skiboot as a payload. This makes QEMU Power9 board simpler to use as skiboot is necessary anyway. Change-Id: I0b49ea7464c97cc2ff0d5030629deed549851372 Signed-off-by: Igor Bagnucki <igor.bagnucki(a)3mdeb.com> Signed-off-by: Krystian Hebel <krystian.hebel(a)3mdeb.com> Signed-off-by: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com> --- M Documentation/mainboard/emulation/qemu-power9.md M payloads/Makefile.inc M payloads/external/.gitignore M payloads/external/Makefile.inc A payloads/external/skiboot/Kconfig A payloads/external/skiboot/Kconfig.name A payloads/external/skiboot/Makefile M src/mainboard/emulation/qemu-power9/Kconfig 8 files changed, 105 insertions(+), 8 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/56/58656/12 -- To view, visit https://review.coreboot.org/c/coreboot/+/58656 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I0b49ea7464c97cc2ff0d5030629deed549851372 Gerrit-Change-Number: 58656 Gerrit-PatchSet: 12 Gerrit-Owner: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com> Gerrit-Reviewer: Igor Bagnucki <igor.bagnucki(a)3mdeb.com> Gerrit-Reviewer: Krystian Hebel <krystian.hebel(a)3mdeb.com> Gerrit-Reviewer: Martin Roth <martinroth(a)google.com> Gerrit-Reviewer: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Gerrit-Reviewer: Timothy Pearson <tpearson(a)raptorengineering.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Martin Roth <martinroth(a)google.com> Gerrit-Attention: Igor Bagnucki <igor.bagnucki(a)3mdeb.com> Gerrit-Attention: Stefan Reinauer <stefan.reinauer(a)coreboot.org> Gerrit-Attention: Krystian Hebel <krystian.hebel(a)3mdeb.com> Gerrit-Attention: Timothy Pearson <tpearson(a)raptorengineering.com> Gerrit-MessageType: newpatchset

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

coreboot-gerrit November 2021