coreboot-gerrit November 2021

coreboot-gerrit@coreboot.org

1 participants
6394 discussions

Change in coreboot[master]: security/intel/txt: Issue a global reset when TXT_RESET bit is set
by Michał Żygowski (Code Review) 25 Nov '21

25 Nov '21

Michał Żygowski has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/59639 ) Change subject: security/intel/txt: Issue a global reset when TXT_RESET bit is set ...................................................................... security/intel/txt: Issue a global reset when TXT_RESET bit is set Although TXT specification says to do power cycle reset if TXT_RESET is set, all Intel provided implementations issue a global reset here. TEST=Perform ungraceful shutdown after SENTER to trigger SCLEAN path on Dell OptiPlex 9010 and successfully call ACM SCLEAN. Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: I8ee2400fab20857ff89b14bb7b662a938b775304 --- M src/security/intel/txt/getsec.c M src/security/intel/txt/romstage.c 2 files changed, 2 insertions(+), 3 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/39/59639/1 diff --git a/src/security/intel/txt/getsec.c b/src/security/intel/txt/getsec.c index 339f2b1..af9b7bb 100644 --- a/src/security/intel/txt/getsec.c +++ b/src/security/intel/txt/getsec.c @@ -12,7 +12,6 @@ #include "txt_register.h" #include "txt_getsec.h" -#include "txt.h" /** * Check for SMX support and enable it if possible. @@ -68,7 +67,7 @@ "IA32_FEATURE_CONTROL MSR locked with GETSEC and/or VMX disabled.\n" "Will perform a full reset to unlock this MSR.\n"); - txt_reset_platform(); + full_reset(); } } diff --git a/src/security/intel/txt/romstage.c b/src/security/intel/txt/romstage.c index f4e099b..63db10f 100644 --- a/src/security/intel/txt/romstage.c +++ b/src/security/intel/txt/romstage.c @@ -108,7 +108,7 @@ printk(BIOS_ERR, "TEE-TXT: Secrets remain in memory. SCLEAN is required.\n"); if (txt_ests & TXT_ESTS_TXT_RESET_STS) { - printk(BIOS_ERR, "TEE-TXT: TXT_RESET bit set, doing full reset!\n"); + printk(BIOS_ERR, "TEE-TXT: TXT_RESET bit set, doing global reset!\n"); txt_reset_platform(); } -- To view, visit https://review.coreboot.org/c/coreboot/+/59639 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I8ee2400fab20857ff89b14bb7b662a938b775304 Gerrit-Change-Number: 59639 Gerrit-PatchSet: 1 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-MessageType: newchange

1 0

Change in coreboot[master]: nb/intel/sandybridge/romstage.c: Configure DPR and initialize TXT
by Michał Żygowski (Code Review) 25 Nov '21

25 Nov '21

Attention is currently required from: Angel Pons, Patrick Rudolph. Hello build bot (Jenkins), Angel Pons, Patrick Rudolph, I'd like you to reexamine a change. Please visit https://review.coreboot.org/c/coreboot/+/59523 to look at the new patch set (#4). Change subject: nb/intel/sandybridge/romstage.c: Configure DPR and initialize TXT ...................................................................... nb/intel/sandybridge/romstage.c: Configure DPR and initialize TXT Initialize the DPR register and check if SCLEAN needs to be run. Allows to reliably boot the platform if ungraceful shutdown occured or the memory controller has been locked by TXT. TEST=Dell OptiPlex 9010 with Intel TXT enabled boots successfully after 4s power button override or power cable unplug when SENTER was executed. Successfully boot QubesOS 4.0 with TBoot v1.8.2 Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: I4b912f121593fa55c11813262f09be1a1055e950 --- M src/northbridge/intel/sandybridge/romstage.c 1 file changed, 23 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/23/59523/4 -- To view, visit https://review.coreboot.org/c/coreboot/+/59523 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I4b912f121593fa55c11813262f09be1a1055e950 Gerrit-Change-Number: 59523 Gerrit-PatchSet: 4 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Attention: Patrick Rudolph <siro(a)das-labor.org> Gerrit-MessageType: newpatchset

1 0

Change in coreboot[master]: security/intel/txt: Fix HEAP_ACM format depending on number of ACMs i...
by Michał Żygowski (Code Review) 25 Nov '21

25 Nov '21

Attention is currently required from: Michał Żygowski. Hello build bot (Jenkins), I'd like you to reexamine a change. Please visit https://review.coreboot.org/c/coreboot/+/59519 to look at the new patch set (#4). Change subject: security/intel/txt: Fix HEAP_ACM format depending on number of ACMs in CBFS ...................................................................... security/intel/txt: Fix HEAP_ACM format depending on number of ACMs in CBFS Since we may have either BIOS ACM or both BIOS and SINIT ACMs in CBFS, the size of txt_heap_acm_element will be different. We cannot always hardcode the size of ACM addresses array for two ACMs. If only the BIOS was included, the BDR parsing failed in TBoot due to invalid size of HEAP_ACM element. Check if SINIT ACM is present in CBFS and push properly formatted BDR region onto the TXT heap. Use two separate txt_heap_acm_element structures with different lengths. TEST=Boot QubesOS 4.0 with TBoot 1.8.2 on Dell OptiPlex 9010 with and without SINTI ACM in CBFS and see that TBoot no longer complains on the wrong size of HEAP_ACM element Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: Ib0c37a66d96e1ca3fb4d3f665e3ad35c6f1c5c1e --- M src/security/intel/txt/ramstage.c M src/security/intel/txt/txt_register.h 2 files changed, 116 insertions(+), 49 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/19/59519/4 -- To view, visit https://review.coreboot.org/c/coreboot/+/59519 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Ib0c37a66d96e1ca3fb4d3f665e3ad35c6f1c5c1e Gerrit-Change-Number: 59519 Gerrit-PatchSet: 4 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Angel Pons <th3fanbus(a)gmail.com> Gerrit-CC: Patrick Rudolph <siro(a)das-labor.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-MessageType: newpatchset

1 0

Change in coreboot[master]: security/intel/txt: Use set_global_reset in txt_reset_platform if pos...
by Michał Żygowski (Code Review) 25 Nov '21

25 Nov '21

Attention is currently required from: Michał Żygowski. Hello build bot (Jenkins), Angel Pons, Patrick Rudolph, I'd like you to reexamine a change. Please visit https://review.coreboot.org/c/coreboot/+/59517 to look at the new patch set (#4). Change subject: security/intel/txt: Use set_global_reset in txt_reset_platform if possible ...................................................................... security/intel/txt: Use set_global_reset in txt_reset_platform if possible Allow to set global reset bits on other platforms which enable SOUTHBRIDGE_INTEL_COMMON_ME. In certain Intel TXT flows global reset instead of full power cycle reset is needed. Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: I561458044860ee5a26f7d61bcff1c407fa1533f2 --- M src/security/intel/txt/common.c M src/security/intel/txt/getsec.c M src/security/intel/txt/romstage.c M src/security/intel/txt/txt.h 4 files changed, 11 insertions(+), 3 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/17/59517/4 -- To view, visit https://review.coreboot.org/c/coreboot/+/59517 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I561458044860ee5a26f7d61bcff1c407fa1533f2 Gerrit-Change-Number: 59517 Gerrit-PatchSet: 4 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-MessageType: newpatchset

1 0

Change in coreboot[master]: security/intel/txt: Implement GETSEC PARAMETER dumping
by Michał Żygowski (Code Review) 25 Nov '21

25 Nov '21

Attention is currently required from: Michał Żygowski, Patrick Rudolph. Hello build bot (Jenkins), Angel Pons, I'd like you to reexamine a change. Please visit https://review.coreboot.org/c/coreboot/+/59516 to look at the new patch set (#4). Change subject: security/intel/txt: Implement GETSEC PARAMETER dumping ...................................................................... security/intel/txt: Implement GETSEC PARAMETER dumping Currently there is only a function that dumps GETSEC CAPABILITIES. Add dumping GETSEC PARAMETER for completeness and additional debug information. Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: I3b2c8337a8d86000a5b43788840d15146b662598 --- M src/security/intel/txt/common.c M src/security/intel/txt/logging.c M src/security/intel/txt/txt_register.h 3 files changed, 46 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/16/59516/4 -- To view, visit https://review.coreboot.org/c/coreboot/+/59516 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I3b2c8337a8d86000a5b43788840d15146b662598 Gerrit-Change-Number: 59516 Gerrit-PatchSet: 4 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Patrick Rudolph <siro(a)das-labor.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Attention: Patrick Rudolph <siro(a)das-labor.org> Gerrit-MessageType: newpatchset

1 0

Change in coreboot[master]: security/intel/txt: Allow to set TXT BIOS Data Region version
by Michał Żygowski (Code Review) 25 Nov '21

25 Nov '21

Attention is currently required from: Michał Żygowski. Hello build bot (Jenkins), Angel Pons, Patrick Rudolph, I'd like you to reexamine a change. Please visit https://review.coreboot.org/c/coreboot/+/59513 to look at the new patch set (#3). Change subject: security/intel/txt: Allow to set TXT BIOS Data Region version ...................................................................... security/intel/txt: Allow to set TXT BIOS Data Region version TXT BIOS Data region version is checked by Trusted Boot code. Older versions of TBoot (e.g. 1.8.2) may refuse to set up the MLE if BDR version is not known. Provide an option to set the BDR version in case an older TBoot code is used. This is very useful for platforms with TPM 1.2. TEST=Set BDR version to 4 and successfully boot QubesOS 4.0 with TBoot 1.8.2 on Dell OptiPlex 9010 Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: Ic2550bd4008559bd47de9e35f8b1c7b52e6e0f5f --- M src/security/intel/txt/Kconfig M src/security/intel/txt/ramstage.c 2 files changed, 13 insertions(+), 4 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/13/59513/3 -- To view, visit https://review.coreboot.org/c/coreboot/+/59513 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Ic2550bd4008559bd47de9e35f8b1c7b52e6e0f5f Gerrit-Change-Number: 59513 Gerrit-PatchSet: 3 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-MessageType: newpatchset

1 0

Change in coreboot[master]: nb/intel/sandybridge: Add support for DPR
by Michał Żygowski (Code Review) 25 Nov '21

25 Nov '21

Attention is currently required from: Michał Żygowski. Hello build bot (Jenkins), Paul Menzel, Angel Pons, Patrick Rudolph, I'd like you to reexamine a change. Please visit https://review.coreboot.org/c/coreboot/+/59512 to look at the new patch set (#3). Change subject: nb/intel/sandybridge: Add support for DPR ...................................................................... nb/intel/sandybridge: Add support for DPR Include DPR in the memory map calculations if enabled. DPR is required for Intel TXT support. TEST=Boot Debian 10 and see the DPR memory being reserved in E820 and cbmem logs: "BIOS-e820: [mem 0x000000007fc09000-0x00000000829fffff] reserved" "TSEG base 0x80000000 size 8M" "DPR base 0x7fd00000 size 3M" Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: Ia22e49ba58709acfa0afe0921aa71d83cc06c129 --- M src/northbridge/intel/sandybridge/memmap.c M src/northbridge/intel/sandybridge/northbridge.c 2 files changed, 43 insertions(+), 4 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/12/59512/3 -- To view, visit https://review.coreboot.org/c/coreboot/+/59512 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Ia22e49ba58709acfa0afe0921aa71d83cc06c129 Gerrit-Change-Number: 59512 Gerrit-PatchSet: 3 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Reviewer: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-MessageType: newpatchset

1 0

Change in coreboot[master]: ec/google/chromeec: Support 5 temperature sensors
by Scott Chao (Code Review) 25 Nov '21

25 Nov '21

Attention is currently required from: Tim Wawrzynczak, Nick Vaccaro. Scott Chao has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/59633 ) Change subject: ec/google/chromeec: Support 5 temperature sensors ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://review.coreboot.org/c/coreboot/+/59633 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Id002230bc872b0f818b0bf2b87987298189c973d Gerrit-Change-Number: 59633 Gerrit-PatchSet: 1 Gerrit-Owner: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Reviewer: Nick Vaccaro <nvaccaro(a)google.com> Gerrit-Reviewer: Scott Chao <scott_chao(a)wistron.corp-partner.google.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Attention: Nick Vaccaro <nvaccaro(a)google.com> Gerrit-Comment-Date: Thu, 25 Nov 2021 00:38:40 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

Change in coreboot[master]: dptf: Add support for one more temperature sensor
by Scott Chao (Code Review) 25 Nov '21

25 Nov '21

Attention is currently required from: Lance Zhao, Tim Wawrzynczak, Sumeet R Pawnikar, Nick Vaccaro, Patrick Rudolph. Scott Chao has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/59632 ) Change subject: dptf: Add support for one more temperature sensor ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://review.coreboot.org/c/coreboot/+/59632 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Ibf9666bade23b9bb4f740c6c4df6ecf5227cfb45 Gerrit-Change-Number: 59632 Gerrit-PatchSet: 1 Gerrit-Owner: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Reviewer: Lance Zhao Gerrit-Reviewer: Nick Vaccaro <nvaccaro(a)google.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Reviewer: Scott Chao <scott_chao(a)wistron.corp-partner.google.com> Gerrit-Reviewer: Sumeet R Pawnikar <sumeet.r.pawnikar(a)intel.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Lance Zhao Gerrit-Attention: Tim Wawrzynczak <twawrzynczak(a)chromium.org> Gerrit-Attention: Sumeet R Pawnikar <sumeet.r.pawnikar(a)intel.com> Gerrit-Attention: Nick Vaccaro <nvaccaro(a)google.com> Gerrit-Attention: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Comment-Date: Thu, 25 Nov 2021 00:38:35 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

Change in coreboot[master]: src/arch/ppc64/*: pass FDT address to payload
by Sergii Dmytruk (Code Review) 25 Nov '21

25 Nov '21

Attention is currently required from: Timothy Pearson, Ron Minnich. Sergii Dmytruk has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/57084 ) Change subject: src/arch/ppc64/*: pass FDT address to payload ...................................................................... Patch Set 20: (1 comment) Patchset: PS20: Made a change to fix building of QEMU power8 target. -- To view, visit https://review.coreboot.org/c/coreboot/+/57084 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I0911f4b534c6f8cacfa057a5bad7576fec711637 Gerrit-Change-Number: 57084 Gerrit-PatchSet: 20 Gerrit-Owner: Sergii Dmytruk <sergii.dmytruk(a)3mdeb.com> Gerrit-Reviewer: Arthur Heymans <arthur(a)aheymans.xyz> Gerrit-Reviewer: Ron Minnich <rminnich(a)gmail.com> Gerrit-Reviewer: Timothy Pearson <tpearson(a)raptorengineering.com> Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-CC: Maciej Pijanowski <maciej.pijanowski(a)3mdeb.com> Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org> Gerrit-Attention: Timothy Pearson <tpearson(a)raptorengineering.com> Gerrit-Attention: Ron Minnich <rminnich(a)gmail.com> Gerrit-Comment-Date: Wed, 24 Nov 2021 23:44:39 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Gerrit-MessageType: comment

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

coreboot-gerrit November 2021