coreboot-gerrit November 2021

coreboot-gerrit@coreboot.org

1 participants
6394 discussions

Change in coreboot[master]: security/intel/txt: Implement GETSEC PARAMETER dumping
by build bot (Jenkins) (Code Review) 21 Nov '21

21 Nov '21

build bot (Jenkins) has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/59516 ) Change subject: security/intel/txt: Implement GETSEC PARAMETER dumping ...................................................................... Patch Set 1: (4 comments) File src/security/intel/txt/common.c: Robot Comment from checkpatch (run ID jenkins-coreboot-checkpatch-133944): https://review.coreboot.org/c/coreboot/+/59516/comment/ec71beaf_24f6193b PS1, Line 446: if (eax & (1 << 7)) { braces {} are not necessary for any arm of this statement Robot Comment from checkpatch (run ID jenkins-coreboot-checkpatch-133944): https://review.coreboot.org/c/coreboot/+/59516/comment/0d561a59_9bc9c836 PS1, Line 453: if (eax & (1 << 8)) { braces {} are not necessary for any arm of this statement File src/security/intel/txt/logging.c: Robot Comment from checkpatch (run ID jenkins-coreboot-checkpatch-133944): https://review.coreboot.org/c/coreboot/+/59516/comment/cf2c012e_7fd5d15c PS1, Line 253: if (txt_feature_flags & GETSEC_PARAMS_TXT_EXT_CRTM_SUPPORT) { braces {} are not necessary for any arm of this statement Robot Comment from checkpatch (run ID jenkins-coreboot-checkpatch-133944): https://review.coreboot.org/c/coreboot/+/59516/comment/25a11432_01ca18a2 PS1, Line 259: if (txt_feature_flags & GETSEC_PARAMS_TXT_EXT_MACHINE_CHECK) { braces {} are not necessary for any arm of this statement -- To view, visit https://review.coreboot.org/c/coreboot/+/59516 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I3b2c8337a8d86000a5b43788840d15146b662598 Gerrit-Change-Number: 59516 Gerrit-PatchSet: 1 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-CC: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Comment-Date: Sun, 21 Nov 2021 17:11:14 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Gerrit-MessageType: comment

1 0

Change in coreboot[master]: nb/intel/sandybridge: Add support for DPR
by build bot (Jenkins) (Code Review) 21 Nov '21

21 Nov '21

Attention is currently required from: Angel Pons, Patrick Rudolph. build bot (Jenkins) has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/59512 ) Change subject: nb/intel/sandybridge: Add support for DPR ...................................................................... Patch Set 1: (1 comment) File src/northbridge/intel/sandybridge/northbridge.c: Robot Comment from checkpatch (run ID jenkins-coreboot-checkpatch-133940): https://review.coreboot.org/c/coreboot/+/59512/comment/f69d3bfb_718bb9b7 PS1, Line 194: dpr_size = dpr.size * MiB ; space prohibited before semicolon -- To view, visit https://review.coreboot.org/c/coreboot/+/59512 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Ia22e49ba58709acfa0afe0921aa71d83cc06c129 Gerrit-Change-Number: 59512 Gerrit-PatchSet: 1 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-CC: build bot (Jenkins) <no-reply(a)coreboot.org> Gerrit-Attention: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Attention: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Comment-Date: Sun, 21 Nov 2021 16:57:38 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Gerrit-MessageType: comment

1 0

Change in coreboot[master]: mb/dell/optiplex_9010/devicetree.cb: Enable missing GPEs
by Michał Żygowski (Code Review) 21 Nov '21

21 Nov '21

Michał Żygowski has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/59526 ) Change subject: mb/dell/optiplex_9010/devicetree.cb: Enable missing GPEs ...................................................................... mb/dell/optiplex_9010/devicetree.cb: Enable missing GPEs Enable PCI_EXP_EN, PME_EN and PME_B0_EN GPEs used for PCI devices. Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: I4480921a294f35a0dfe1e5acd90d55f6fb4c85b4 --- M src/mainboard/dell/optiplex_9010/devicetree.cb 1 file changed, 1 insertion(+), 1 deletion(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/26/59526/1 diff --git a/src/mainboard/dell/optiplex_9010/devicetree.cb b/src/mainboard/dell/optiplex_9010/devicetree.cb index ec585b9..fd95081 100644 --- a/src/mainboard/dell/optiplex_9010/devicetree.cb +++ b/src/mainboard/dell/optiplex_9010/devicetree.cb @@ -20,7 +20,7 @@ device pci 06.0 off end # PEG2 chip southbridge/intel/bd82x6x # Intel Series 7 Panther Point PCH - register "gpe0_en" = "0x00000146" + register "gpe0_en" = "0x00002a46" register "alt_gp_smi_en" = "0x0004" register "gpi2_routing" = "1" register "gpi12_routing" = "2" -- To view, visit https://review.coreboot.org/c/coreboot/+/59526 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I4480921a294f35a0dfe1e5acd90d55f6fb4c85b4 Gerrit-Change-Number: 59526 Gerrit-PatchSet: 1 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-MessageType: newchange

1 0

Change in coreboot[master]: mb/dell/optiplex_9010/romstage.c: Add interrupt routing map
by Michał Żygowski (Code Review) 21 Nov '21

21 Nov '21

Michał Żygowski has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/59525 ) Change subject: mb/dell/optiplex_9010/romstage.c: Add interrupt routing map ...................................................................... mb/dell/optiplex_9010/romstage.c: Add interrupt routing map Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: Ifdc41a1e6627b68813fb264aed7e30df58fc6d54 --- M src/mainboard/dell/optiplex_9010/romstage.c 1 file changed, 13 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/25/59525/1 diff --git a/src/mainboard/dell/optiplex_9010/romstage.c b/src/mainboard/dell/optiplex_9010/romstage.c index 36af6e4..889b06d 100644 --- a/src/mainboard/dell/optiplex_9010/romstage.c +++ b/src/mainboard/dell/optiplex_9010/romstage.c @@ -5,12 +5,25 @@ #include <console/console.h> #include <northbridge/intel/sandybridge/sandybridge.h> #include <northbridge/intel/sandybridge/raminit_native.h> +#include <southbridge/intel/common/rcba.h> #include <southbridge/intel/bd82x6x/pch.h> #include <superio/smsc/sch5545/sch5545.h> #include <superio/smsc/sch5545/sch5545_emi.h> #include "sch5545_ec.h" +void mainboard_late_rcba_config(void) +{ + DIR_ROUTE(D31IR, PIRQA, PIRQD, PIRQC, PIRQA); + DIR_ROUTE(D29IR, PIRQH, PIRQD, PIRQA, PIRQC); + DIR_ROUTE(D28IR, PIRQA, PIRQB, PIRQC, PIRQD); + DIR_ROUTE(D27IR, PIRQG, PIRQB, PIRQC, PIRQD); + DIR_ROUTE(D26IR, PIRQA, PIRQF, PIRQC, PIRQD); + DIR_ROUTE(D25IR, PIRQE, PIRQF, PIRQG, PIRQH); + DIR_ROUTE(D22IR, PIRQA, PIRQD, PIRQC, PIRQB); + DIR_ROUTE(D20IR, PIRQA, PIRQB, PIRQC, PIRQD); +} + void mainboard_early_init(int s3resume) { uint16_t ec_fw_version; -- To view, visit https://review.coreboot.org/c/coreboot/+/59525 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Ifdc41a1e6627b68813fb264aed7e30df58fc6d54 Gerrit-Change-Number: 59525 Gerrit-PatchSet: 1 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-MessageType: newchange

1 0

Change in coreboot[master]: superio/smsc/sch5545: Fix KBD and Runtime Registers init
by Michał Żygowski (Code Review) 21 Nov '21

21 Nov '21

Attention is currently required from: Felix Held. Michał Żygowski has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/59524 ) Change subject: superio/smsc/sch5545: Fix KBD and Runtime Registers init ...................................................................... superio/smsc/sch5545: Fix KBD and Runtime Registers init Disable PS/2 data and clock isolation in order to properly initialize the PS/2 keyboard and mouse in payload/OS. Also disable PMEs and clear global PME status to avoid undesired wakeups or hangs. These bits are set by OS via ACPI can survive S5 state so it is necessary to set them back to defaults after an ungraceful shutdown. TEST=Dell OptiPlex 9010 does not hang anymore after ungraceful shutdown when configuring GPE0_EN register in southbridge LPC init and PS/2 keyboard can be always initialized in SeaBIOS Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: I790cac3ce1101565b64ed54d9c6b50f5e9aa4cf6 --- M src/superio/smsc/sch5545/sch5545_early_init.c M src/superio/smsc/sch5545/superio.c 2 files changed, 12 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/24/59524/1 diff --git a/src/superio/smsc/sch5545/sch5545_early_init.c b/src/superio/smsc/sch5545/sch5545_early_init.c index ed4fa53..d77ed0d 100644 --- a/src/superio/smsc/sch5545/sch5545_early_init.c +++ b/src/superio/smsc/sch5545/sch5545_early_init.c @@ -100,6 +100,13 @@ sch5545_set_led(SCH5545_RUNTIME_REG_BASE, SCH5545_LED_COLOR_GREEN, SCH5545_LED_BLINK_ON); + /* + * Clear global PME status and disable PME generation to avoid + * unexpected wakeups or hangs. OS will re-enable it via ACPI. + */ + outb(0, SCH5545_RUNTIME_REG_BASE + SCH5545_RR_PME_EN); + outb(1, SCH5545_RUNTIME_REG_BASE + SCH5545_RR_PME_STS); + /* Configure EMI */ dev = PNP_DEV(port, SCH5545_LDN_LPC); pnp_set_logical_device(dev); diff --git a/src/superio/smsc/sch5545/superio.c b/src/superio/smsc/sch5545/superio.c index b6e5308..a819ae7 100644 --- a/src/superio/smsc/sch5545/superio.c +++ b/src/superio/smsc/sch5545/superio.c @@ -62,6 +62,11 @@ switch (dev->path.pnp.device) { case SCH5545_LDN_KBC: + pnp_enter_conf_mode(dev); + pnp_set_logical_device(dev); + /* Disable PS/2 clock and data isolation */ + pnp_write_config(dev, 0xf0, pnp_read_config(dev, 0xf0) & 0x9f); + pnp_exit_conf_mode(dev); pc_keyboard_init(NO_AUX_DEVICE); break; case SCH5545_LDN_LPC: -- To view, visit https://review.coreboot.org/c/coreboot/+/59524 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I790cac3ce1101565b64ed54d9c6b50f5e9aa4cf6 Gerrit-Change-Number: 59524 Gerrit-PatchSet: 1 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Felix Held <felix-coreboot(a)felixheld.de> Gerrit-Attention: Felix Held <felix-coreboot(a)felixheld.de> Gerrit-MessageType: newchange

1 0

Change in coreboot[master]: nb/intel/sandybridge/romstage.c: Configure DPR and initialize TXT
by Michał Żygowski (Code Review) 21 Nov '21

21 Nov '21

Attention is currently required from: Angel Pons, Patrick Rudolph. Michał Żygowski has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/59523 ) Change subject: nb/intel/sandybridge/romstage.c: Configure DPR and initialize TXT ...................................................................... nb/intel/sandybridge/romstage.c: Configure DPR and initialize TXT Initialize the DPR register and check if SCLEAN needs to be run. Allows to reliably boot the platform if ungraceful shutdown occured or the memory controller has been locked by TXT. TEST=Dell OptiPlex 9010 with Intel TXT enabled boots successfully after 4s power button override or power cable unplug when SENTER was executed. Successfully boot QubesOS 4.0 with TBoot v1.8.2 Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: I4b912f121593fa55c11813262f09be1a1055e950 --- M src/northbridge/intel/sandybridge/romstage.c 1 file changed, 20 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/23/59523/1 diff --git a/src/northbridge/intel/sandybridge/romstage.c b/src/northbridge/intel/sandybridge/romstage.c index d6e7ee9..15608cf 100644 --- a/src/northbridge/intel/sandybridge/romstage.c +++ b/src/northbridge/intel/sandybridge/romstage.c @@ -10,6 +10,9 @@ #include <device/pci_def.h> #include <device/device.h> #include <northbridge/intel/sandybridge/chip.h> +#include <security/intel/txt/txt.h> +#include <security/intel/txt/txt_platform.h> +#include <security/intel/txt/txt_register.h> #include <southbridge/intel/bd82x6x/pch.h> #include <southbridge/intel/common/pmclib.h> #include <elog.h> @@ -22,6 +25,18 @@ { } +#if CONFIG(INTEL_TXT) +static void configure_dpr(void) +{ + union dpr_register dpr = txt_get_chipset_dpr(); + + dpr.lock = 1; + dpr.epm = 1; + dpr.size = CONFIG_INTEL_TXT_DPR_SIZE; /* 3 MiB should be enough */ + pci_write_config32(HOST_BRIDGE, DPR, dpr.raw); +} +#endif + static void early_pch_reset_pmcon(void) { /* Reset RTC power status */ @@ -60,6 +75,11 @@ post_code(0x39); +#if CONFIG(INTEL_TXT) + configure_dpr(); + intel_txt_romstage_init(); +#endif + perform_raminit(s3resume); post_code(0x3b); -- To view, visit https://review.coreboot.org/c/coreboot/+/59523 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: I4b912f121593fa55c11813262f09be1a1055e950 Gerrit-Change-Number: 59523 Gerrit-PatchSet: 1 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-Reviewer: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Reviewer: Patrick Rudolph <siro(a)das-labor.org> Gerrit-Attention: Angel Pons <th3fanbus(a)gmail.com> Gerrit-Attention: Patrick Rudolph <siro(a)das-labor.org> Gerrit-MessageType: newchange

1 0

Change in coreboot[master]: mb/dell/optiplex_9010/Kconfig: Select Super I/O UART availability
by Michał Żygowski (Code Review) 21 Nov '21

21 Nov '21

Michał Żygowski has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/59522 ) Change subject: mb/dell/optiplex_9010/Kconfig: Select Super I/O UART availability ...................................................................... mb/dell/optiplex_9010/Kconfig: Select Super I/O UART availability Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: Ie1b270d49660fd60b6a91194167467c4453e1b6b --- M src/mainboard/dell/optiplex_9010/Kconfig 1 file changed, 1 insertion(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/22/59522/1 diff --git a/src/mainboard/dell/optiplex_9010/Kconfig b/src/mainboard/dell/optiplex_9010/Kconfig index ac0912b..90d4b84 100644 --- a/src/mainboard/dell/optiplex_9010/Kconfig +++ b/src/mainboard/dell/optiplex_9010/Kconfig @@ -19,6 +19,7 @@ select HAVE_OPTION_TABLE select HAVE_CMOS_DEFAULT select PCIEXP_L1_SUB_STATE + select DRIVERS_UART_8250IO config MAINBOARD_DIR default "dell/optiplex_9010" -- To view, visit https://review.coreboot.org/c/coreboot/+/59522 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Ie1b270d49660fd60b6a91194167467c4453e1b6b Gerrit-Change-Number: 59522 Gerrit-PatchSet: 1 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-MessageType: newchange

1 0

Change in coreboot[master]: security/intel/txt/romstage.c: Unlock memory when SCLEAN not needed
by Michał Żygowski (Code Review) 21 Nov '21

21 Nov '21

Michał Żygowski has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/59521 ) Change subject: security/intel/txt/romstage.c: Unlock memory when SCLEAN not needed ...................................................................... security/intel/txt/romstage.c: Unlock memory when SCLEAN not needed If TPM establishment is not asserted simply write to the MSR to unlock memory on a TXT enabled platform. Previosuly on Sandybridge raminit the algorithm was stuck at being unable to lock MPLL when the memory controller was not unlocked with the MSR. TEST=Successfully train the DRAM on Dell OptiPlex 9010 with i7-3770/Q77 with Intel TXT enabled Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: Idd29d163a2310f0b574fc72d575f23088ab1d11d --- M src/security/intel/txt/romstage.c M src/security/intel/txt/txt_register.h 2 files changed, 10 insertions(+), 0 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/21/59521/1 diff --git a/src/security/intel/txt/romstage.c b/src/security/intel/txt/romstage.c index 009f3cb..49278d4 100644 --- a/src/security/intel/txt/romstage.c +++ b/src/security/intel/txt/romstage.c @@ -130,5 +130,10 @@ /* FIXME: vboot A/B could be used to recover, but has not been tested */ die("Could not execute BIOS ACM to unlock the memory.\n"); + } else if (!establishment) { + /* We don't need to run SCLEAN, simply unlock the memory */ + printk(BIOS_INFO, "TEE-TXT: Unlocking memory\n"); + msr_t msr = {.lo = 0, .hi = 0 }; + wrmsr(TXT_UNLOCK_MEMORY_MSR, msr); } } diff --git a/src/security/intel/txt/txt_register.h b/src/security/intel/txt/txt_register.h index baec726..32d6c2e 100644 --- a/src/security/intel/txt/txt_register.h +++ b/src/security/intel/txt/txt_register.h @@ -99,6 +99,11 @@ #define TXT_E2STS_SECRET_STS (1ull << 1) /* + * TXT MSRs + */ +#define TXT_UNLOCK_MEMORY_MSR 0x2e6 + +/* * TCG PC Client Platform TPM Profile (PTP) Specification * * Note: Only locality 0 registers are publicly accessible. -- To view, visit https://review.coreboot.org/c/coreboot/+/59521 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Idd29d163a2310f0b574fc72d575f23088ab1d11d Gerrit-Change-Number: 59521 Gerrit-PatchSet: 1 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-MessageType: newchange

1 0

Change in coreboot[master]: security/intel/txt: Fix GETSEC checks in romstage
by Michał Żygowski (Code Review) 21 Nov '21

21 Nov '21

Michał Żygowski has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/59520 ) Change subject: security/intel/txt: Fix GETSEC checks in romstage ...................................................................... security/intel/txt: Fix GETSEC checks in romstage IA32_FEATURE_CONTROL does not need to be checked by BIOS, in fact these bits are needed only by SENTER and SINIT ACM. ACM ENTERACCS does not check these bits according to Intel SDM. Also noticed that the lock bit of IA32_FEATURE_CONTROL cannot be cleared by issuing neither global reset nor full reset on Sandybridge/Ivybridge platforms which results in a reset loop. However, check the IA32_FEATURE_CONTROL SENTER bits in ramstage where the register is properly set on all cores already. TEST=Run ACM SCLEAN on Dell OptiPlex 9010 with i7-3770/Q77 Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: Ie9103041498f557b85019a56e1252090a4fcd0c9 --- M src/security/intel/txt/getsec.c M src/security/intel/txt/romstage.c 2 files changed, 31 insertions(+), 11 deletions(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/20/59520/1 diff --git a/src/security/intel/txt/getsec.c b/src/security/intel/txt/getsec.c index e85de7d..ca6d9a3 100644 --- a/src/security/intel/txt/getsec.c +++ b/src/security/intel/txt/getsec.c @@ -9,9 +9,11 @@ #include <cpu/x86/mp.h> #include <cpu/x86/msr.h> #include <types.h> +#include <rules.h> #include "txt_register.h" #include "txt_getsec.h" +#include "txt.h" /** * Check for SMX support and enable it if possible. @@ -24,16 +26,26 @@ /* * Check if SMX and VMX is supported by CPU. */ - if (!(ecx & CPUID_SMX) || !(ecx & CPUID_VMX)) + if (!(ecx & CPUID_SMX) || !(ecx & CPUID_VMX)) { + printk(BIOS_ERR, "SMX/VMX not supported by CPU\n"); return false; - + } /* - * Check if SMX, VMX and GetSec instructions haven't been disabled. + * This requirement is not needed for ENTERACCS, but for SENTER (see SDM). + * Skip check in romstage because IA32_FEATURE_CONTROL cannot be unlocked + * even after a global reset e.g. on Sandy/IvyBridge. However the register + * gets set properly in ramstage where all CPUs are already initialized. */ - msr_t msr = rdmsr(IA32_FEATURE_CONTROL); - if ((msr.lo & 0xff06) != 0xff06) - return false; - + if (!ENV_ROMSTAGE_OR_BEFORE) { + /* + * Check if SMX, VMX and GetSec instructions haven't been disabled. + */ + msr_t msr = rdmsr(IA32_FEATURE_CONTROL); + if ((msr.lo & 0xff06) != 0xff06) { + printk(BIOS_ERR, "GETSEC not enabled in IA32_FEATURE_CONTROL MSR\n"); + return false; + } + } /* * Enable SMX. Required to execute GetSec instruction. * Chapter 2.2.4.3 diff --git a/src/security/intel/txt/romstage.c b/src/security/intel/txt/romstage.c index f4e099b..009f3cb 100644 --- a/src/security/intel/txt/romstage.c +++ b/src/security/intel/txt/romstage.c @@ -5,6 +5,7 @@ #include <cf9_reset.h> #include <console/console.h> #include <cpu/intel/common/common.h> +#include <cpu/x86/cr.h> #include <cpu/x86/msr.h> #include <southbridge/intel/common/pmbase.h> #include <timer.h> @@ -83,14 +84,21 @@ void intel_txt_romstage_init(void) { /* Bail early if the CPU doesn't support TXT */ - if (!is_txt_cpu()) + if (!is_txt_cpu()) { + printk(BIOS_ERR, "TEE-TXT: CPU not TXT capable.\n"); return; + } - /* We need to use GETSEC here, so enable it */ - enable_getsec_or_reset(); + /* + * We need to use GETSEC here, so enable it. + * CR4_SMXE is all we need to be able to call GETSEC[CAPABILTIES]. + */ + write_cr4(read_cr4() | CR4_SMXE); - if (!is_txt_chipset()) + if (!is_txt_chipset()) { + printk(BIOS_ERR, "TEE-TXT: Chipset not TXT capable.\n"); return; + } const uint8_t txt_ests = read8((void *)TXT_ESTS); -- To view, visit https://review.coreboot.org/c/coreboot/+/59520 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Ie9103041498f557b85019a56e1252090a4fcd0c9 Gerrit-Change-Number: 59520 Gerrit-PatchSet: 1 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-MessageType: newchange

1 0

Change in coreboot[master]: security/intel/txt/ramstage.c: Fix HEAP_ACM element size calculation
by Michał Żygowski (Code Review) 21 Nov '21

21 Nov '21

Michał Żygowski has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/59519 ) Change subject: security/intel/txt/ramstage.c: Fix HEAP_ACM element size calculation ...................................................................... security/intel/txt/ramstage.c: Fix HEAP_ACM element size calculation Signed-off-by: Michał Żygowski <michal.zygowski(a)3mdeb.com> Change-Id: Ib0c37a66d96e1ca3fb4d3f665e3ad35c6f1c5c1e --- M src/security/intel/txt/ramstage.c 1 file changed, 13 insertions(+), 1 deletion(-) git pull ssh://review.coreboot.org:29418/coreboot refs/changes/19/59519/1 diff --git a/src/security/intel/txt/ramstage.c b/src/security/intel/txt/ramstage.c index 217d50c..450cfc5 100644 --- a/src/security/intel/txt/ramstage.c +++ b/src/security/intel/txt/ramstage.c @@ -258,7 +258,6 @@ /* Extended elements - ACM addresses */ data.heap_acm.header.type = HEAP_EXTDATA_TYPE_ACM; - data.heap_acm.header.size = sizeof(data.heap_acm); if (data.bdr.bios_sinit_size) { data.heap_acm.num_acms = 2; data.heap_acm.acm_addrs[1] = (uintptr_t)sinit_base; @@ -267,6 +266,19 @@ } data.heap_acm.acm_addrs[0] = (uintptr_t)cbfs_map(CONFIG_INTEL_TXT_CBFS_BIOS_ACM, NULL); + + /* + * FIXME: these calculations handle the lack of SINIT ACM in CBFS. + * Fixed size of the data.heap_acm.acm_addrs array does not allow to + * properly set up the BDR region when SINIT ACM is not present in CBFS. + * Each structure in the data variable defined on the beginning of this + * function should be assembled and appended on the fly taking into + * account the size of given BDR element. + */ + data.heap_acm.header.size = sizeof(data.heap_acm.header) + + sizeof(data.heap_acm.num_acms) + + data.heap_acm.num_acms * sizeof(data.heap_acm.acm_addrs); + /* Extended elements - End marker */ data.end.type = HEAP_EXTDATA_TYPE_END; data.end.size = sizeof(data.end); -- To view, visit https://review.coreboot.org/c/coreboot/+/59519 To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings Gerrit-Project: coreboot Gerrit-Branch: master Gerrit-Change-Id: Ib0c37a66d96e1ca3fb4d3f665e3ad35c6f1c5c1e Gerrit-Change-Number: 59519 Gerrit-PatchSet: 1 Gerrit-Owner: Michał Żygowski <michal.zygowski(a)3mdeb.com> Gerrit-MessageType: newchange

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

coreboot-gerrit November 2021