coreboot-gerrit November 2021

coreboot-gerrit@coreboot.org

1 participants
6394 discussions

Change in coreboot[master]: security/intel/txt/romstage.c: Unlock memory when SCLEAN not needed
by Michał Żygowski (Code Review) 25 Nov '21

25 Nov '21

Attention is currently required from: Michał Żygowski, Patrick Rudolph. Hello build bot (Jenkins), Patrick Rudolph, I'd like you to reexamine a change. Please visit https://review.coreboot.org/c/coreboot/+/59521 to look at the new patch set (#5). Change subject: security/intel/txt/romstage.c: Unlock memory when SCLEAN not needed ...................................................................... security/intel/txt/romstage.c: Unlock memory when SCLEAN not needed If TPM establishment is not asserted simply write to the MSR to unlock memory on a TXT enabled platform. Previosuly on Sandybridge raminit the algorithm was stuck at being unable to lock MPLL when the memory controller was not unlocked with the MSR. TEST=Successfully train the DRAM on Dell OptiPlex 9010 with i7-3770/Q77 with Intel TXT enabled Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: Idd29d163a2310f0b574fc72d575f23088ab1d11d --- M src/security/intel/txt/romstage.c M src/security/intel/txt/txt_register.h 2 files changed, 10 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/21/59521/5 -- To view, visit https://review.coreboot.org/c/coreboot/+/59521 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Idd29d163a2310f0b574fc72d575f23088ab1d11d Gerrit-Change-Number: 59521 Gerrit-PatchSet: 5 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Angel Pons <th3fanbus(a)gmail.com> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Attention: Patrick Rudolph <siro(a)das-labor.org> Gerrit-MessageType: newpatchset

1 0

Change in coreboot[master]: security/intel/txt: Fix GETSEC checks in romstage
by Michał Żygowski (Code Review) 25 Nov '21

25 Nov '21

Attention is currently required from: Angel Pons. Hello build bot (Jenkins), Patrick Rudolph, I'd like you to reexamine a change. Please visit https://review.coreboot.org/c/coreboot/+/59520 to look at the new patch set (#5). Change subject: security/intel/txt: Fix GETSEC checks in romstage ...................................................................... security/intel/txt: Fix GETSEC checks in romstage IA32_FEATURE_CONTROL does not need to be checked by BIOS, in fact these bits are needed only by SENTER and SINIT ACM. ACM ENTERACCS does not check these bits according to Intel SDM. Also noticed that the lock bit of IA32_FEATURE_CONTROL cannot be cleared by issuing neither global reset nor full reset on Sandybridge/Ivybridge platforms which results in a reset loop. However, check the IA32_FEATURE_CONTROL SENTER bits in ramstage where the register is properly set on all cores already. TEST=Run ACM SCLEAN on Dell OptiPlex 9010 with i7-3770/Q77 Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: Ie9103041498f557b85019a56e1252090a4fcd0c9 --- M src/security/intel/txt/getsec.c M src/security/intel/txt/romstage.c 2 files changed, 31 insertions(+), 11 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/20/59520/5 -- To view, visit https://review.coreboot.org/c/coreboot/+/59520 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Ie9103041498f557b85019a56e1252090a4fcd0c9 Gerrit-Change-Number: 59520 Gerrit-PatchSet: 5 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Angel Pons <th3fanbus(a)gmail.com> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Angel Pons <th3fanbus(a)gmail.com> Gerrit-MessageType: newpatchset

1 0

Change in coreboot[master]: security/intel/txt: Fix HEAP_ACM format depending on number of ACMs i...
by Michał Żygowski (Code Review) 25 Nov '21

25 Nov '21

Attention is currently required from: Michał Żygowski. Hello build bot (Jenkins), I'd like you to reexamine a change. Please visit https://review.coreboot.org/c/coreboot/+/59519 to look at the new patch set (#5). Change subject: security/intel/txt: Fix HEAP_ACM format depending on number of ACMs in CBFS ...................................................................... security/intel/txt: Fix HEAP_ACM format depending on number of ACMs in CBFS Since we may have either BIOS ACM or both BIOS and SINIT ACMs in CBFS, the size of txt_heap_acm_element will be different. We cannot always hardcode the size of ACM addresses array for two ACMs. If only the BIOS was included, the BDR parsing failed in TBoot due to invalid size of HEAP_ACM element. Check if SINIT ACM is present in CBFS and push properly formatted BDR region onto the TXT heap. Use two separate txt_heap_acm_element structures with different lengths. TEST=Boot QubesOS 4.0 with TBoot 1.8.2 on Dell OptiPlex 9010 with and without SINTI ACM in CBFS and see that TBoot no longer complains on the wrong size of HEAP_ACM element Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: Ib0c37a66d96e1ca3fb4d3f665e3ad35c6f1c5c1e --- M src/security/intel/txt/ramstage.c M src/security/intel/txt/txt_register.h 2 files changed, 116 insertions(+), 49 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/19/59519/5 -- To view, visit https://review.coreboot.org/c/coreboot/+/59519 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Ib0c37a66d96e1ca3fb4d3f665e3ad35c6f1c5c1e Gerrit-Change-Number: 59519 Gerrit-PatchSet: 5 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Angel Pons <th3fanbus(a)gmail.com> Gerrit-CC: Patrick Rudolph <siro(a)das-labor.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-MessageType: newpatchset

1 0

Change in coreboot[master]: security/intel/txt: Allow platforms without FIT enable Intel TXT
by Michał Żygowski (Code Review) 25 Nov '21

25 Nov '21

Attention is currently required from: Michał Żygowski. Hello build bot (Jenkins), Angel Pons, Patrick Rudolph, I'd like you to reexamine a change. Please visit https://review.coreboot.org/c/coreboot/+/59518 to look at the new patch set (#5). Change subject: security/intel/txt: Allow platforms without FIT enable Intel TXT ...................................................................... security/intel/txt: Allow platforms without FIT enable Intel TXT There is no real code or feature dependency on CPU_INTEL_FIRMWARE_INTERFACE_TABLE for Intel TXT. Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: I2858c8de9396449a0ee30837a98fab05570a6259 --- M src/security/intel/txt/Kconfig 1 file changed, 0 insertions(+), 1 deletion(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/18/59518/5 -- To view, visit https://review.coreboot.org/c/coreboot/+/59518 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I2858c8de9396449a0ee30837a98fab05570a6259 Gerrit-Change-Number: 59518 Gerrit-PatchSet: 5 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-MessageType: newpatchset

1 0

Change in coreboot[master]: security/intel/txt/Kconfig:: Add dependency on SOUTHBRIDGE_INTEL_COMM...
by Michał Żygowski (Code Review) 25 Nov '21

25 Nov '21

Michał Żygowski has uploaded a new patch set (#2). ( https://review.coreboot.org/c/coreboot/+/59640 ) Change subject: security/intel/txt/Kconfig:: Add dependency on SOUTHBRIDGE_INTEL_COMMON_ME ...................................................................... security/intel/txt/Kconfig:: Add dependency on SOUTHBRIDGE_INTEL_COMMON_ME Add optional dependency on SOUTHBRIDGE_INTEL_COMMON_ME in order to ensure that a global reset implementation is provided by at least one of: SOUTHBRIDGE_INTEL_COMMON_ME or SOC_INTEL_COMMON_BLOCK_SA. Also separate HAVE_CF9_RESET dependency since the TXT driver code relies on it too. Now the dependiences ensure that all reset types are available. Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: I8a4b5404d609006672bf41d81c696a47e078a1d2 --- M src/security/intel/txt/Kconfig 1 file changed, 2 insertions(+), 1 deletion(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/40/59640/2 -- To view, visit https://review.coreboot.org/c/coreboot/+/59640 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I8a4b5404d609006672bf41d81c696a47e078a1d2 Gerrit-Change-Number: 59640 Gerrit-PatchSet: 2 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-MessageType: newpatchset

1 0

Change in coreboot[master]: security/intel/txt: Use set_global_reset in txt_reset_platform if pos...
by Michał Żygowski (Code Review) 25 Nov '21

25 Nov '21

Attention is currently required from: Michał Żygowski. Hello build bot (Jenkins), Angel Pons, Patrick Rudolph, I'd like you to reexamine a change. Please visit https://review.coreboot.org/c/coreboot/+/59517 to look at the new patch set (#5). Change subject: security/intel/txt: Use set_global_reset in txt_reset_platform if possible ...................................................................... security/intel/txt: Use set_global_reset in txt_reset_platform if possible Allow to set global reset bits on other platforms which enable SOUTHBRIDGE_INTEL_COMMON_ME. In certain Intel TXT flows global reset instead of full power cycle reset is needed. Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: I561458044860ee5a26f7d61bcff1c407fa1533f2 --- M src/security/intel/txt/common.c M src/security/intel/txt/getsec.c M src/security/intel/txt/romstage.c M src/security/intel/txt/txt.h 4 files changed, 10 insertions(+), 2 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/17/59517/5 -- To view, visit https://review.coreboot.org/c/coreboot/+/59517 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I561458044860ee5a26f7d61bcff1c407fa1533f2 Gerrit-Change-Number: 59517 Gerrit-PatchSet: 5 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-MessageType: newpatchset

1 0

Change in coreboot[master]: security/intel/txt: Implement GETSEC PARAMETER dumping
by Michał Żygowski (Code Review) 25 Nov '21

25 Nov '21

Attention is currently required from: Angel Pons, Patrick Rudolph. Michał Żygowski has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/59516 ) Change subject: security/intel/txt: Implement GETSEC PARAMETER dumping ...................................................................... Patch Set 4: (1 comment) File src/security/intel/txt/logging.c: https://review.coreboot.org/c/coreboot/+/59516/comment/17c45c42_3ee51af5 PS3, Line 226: txt_dump_parameters > I'd name this function `txt_dump_getsec_parameters` Done -- To view, visit https://review.coreboot.org/c/coreboot/+/59516 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I3b2c8337a8d86000a5b43788840d15146b662598 Gerrit-Change-Number: 59516 Gerrit-PatchSet: 4 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Patrick Rudolph <siro(a)das-labor.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Attention: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Comment-Date: Thu, 25 Nov 2021 00:49:05 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Angel Pons <th3fanbus(a)gmail.com> Gerrit-MessageType: comment

1 0

Change in coreboot[master]: security/intel/txt: Allow to set TXT BIOS Data Region version
by Michał Żygowski (Code Review) 25 Nov '21

25 Nov '21

Attention is currently required from: Paul Menzel, Angel Pons. Michał Żygowski has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/59513 ) Change subject: security/intel/txt: Allow to set TXT BIOS Data Region version ...................................................................... Patch Set 3: (2 comments) File src/security/intel/txt/Kconfig: https://review.coreboot.org/c/coreboot/+/59513/comment/a5ef44f0_254d036e PS2, Line 49: older Trusted Boot version > Can you give a specific version? Added to commit message https://review.coreboot.org/c/coreboot/+/59513/comment/33ba2d7c_c294e34c PS2, Line 54: > nit: drop one empty line Done -- To view, visit https://review.coreboot.org/c/coreboot/+/59513 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Ic2550bd4008559bd47de9e35f8b1c7b52e6e0f5f Gerrit-Change-Number: 59513 Gerrit-PatchSet: 3 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Comment-Date: Thu, 25 Nov 2021 00:48:33 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Paul Menzel <paulepanter(a)mailbox.org> Comment-In-Reply-To: Angel Pons <th3fanbus(a)gmail.com> Gerrit-MessageType: comment

1 0

Change in coreboot[master]: nb/intel/sandybridge: Add support for DPR
by Michał Żygowski (Code Review) 25 Nov '21

25 Nov '21

Attention is currently required from: Paul Menzel. Michał Żygowski has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/59512 ) Change subject: nb/intel/sandybridge: Add support for DPR ...................................................................... Patch Set 3: (1 comment) Commit Message: https://review.coreboot.org/c/coreboot/+/59512/comment/bbf46c11_96374752 PS2, Line 11: > Maybe paste the new debug log line from the running system in TEST=. Done -- To view, visit https://review.coreboot.org/c/coreboot/+/59512 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Ia22e49ba58709acfa0afe0921aa71d83cc06c129 Gerrit-Change-Number: 59512 Gerrit-PatchSet: 3 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Reviewer: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Comment-Date: Thu, 25 Nov 2021 00:47:47 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-MessageType: comment

1 0

Change in coreboot[master]: security/intel/txt/Kconfig:: Add dependency on SOUTHBRIDGE_INTEL_COMM...
by Michał Żygowski (Code Review) 25 Nov '21

25 Nov '21

Michał Żygowski has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/59640 ) Change subject: security/intel/txt/Kconfig:: Add dependency on SOUTHBRIDGE_INTEL_COMMON_ME ...................................................................... security/intel/txt/Kconfig:: Add dependency on SOUTHBRIDGE_INTEL_COMMON_ME Add optional dependency on SOUTHBRIDGE_INTEL_COMMON_ME in order to ensure that a global reset implementation is provided by at least one of: SOUTHBRIDGE_INTEL_COMMON_ME or SOC_INTEL_COMMON_BLOCK_SA. Also separate HAVE_CF9_RESET dependency since the TXT driver code relies on it too. Now the dependiences ensure that all reset types are available. Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: I8a4b5404d609006672bf41d81c696a47e078a1d2 --- M src/security/intel/txt/Kconfig 1 file changed, 2 insertions(+), 1 deletion(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/40/59640/1 diff --git a/src/security/intel/txt/Kconfig b/src/security/intel/txt/Kconfig index 6d23583..555a680 100644 --- a/src/security/intel/txt/Kconfig +++ b/src/security/intel/txt/Kconfig @@ -10,7 +10,8 @@ depends on TPM depends on CPU_INTEL_FIRMWARE_INTERFACE_TABLE depends on PLATFORM_HAS_DRAM_CLEAR - depends on (SOC_INTEL_COMMON_BLOCK_SA || HAVE_CF9_RESET) + depends on HAVE_CF9_RESET + depends on (SOC_INTEL_COMMON_BLOCK_SA || SOUTHBRIDGE_INTEL_COMMON_ME) if INTEL_TXT -- To view, visit https://review.coreboot.org/c/coreboot/+/59640 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I8a4b5404d609006672bf41d81c696a47e078a1d2 Gerrit-Change-Number: 59640 Gerrit-PatchSet: 1 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-MessageType: newchange

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

coreboot-gerrit November 2021